Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2025-30406 is a critical-severity Use of Hard-coded Cryptographic Key (CWE-321) vulnerability in Gladinet Centrestack. Its CVSS base score is 9.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unsecured Credentials (T1552); ranked in the top 0.2% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified map to IA-5 (Authenticator Management) and SC-12 (Cryptographic Key Establishment and Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Gladinet CentreStack through version 16.1.10296.56315 contains a deserialization vulnerability in the CentreStack portal stemming from use of a hardcoded machineKey, with the issue corrected in version 16.4.10315.56368. The weakness is tracked under CWE-321 and CWE-798 and carries a CVSS 3.1 score of 9.0 reflecting network attackability with high impact across confidentiality, integrity, and availability when the key is known.
An attacker in possession of the machineKey can craft and serialize a malicious payload that the server will deserialize, resulting in remote code execution. The vulnerability was exploited in the wild during March 2025, and successful exploitation requires no user interaction or prior authentication beyond knowledge of the key.
Vendor guidance and the referenced security advisory indicate that administrators can mitigate the issue by manually removing the machineKey entry from portal\web.config, while the CISA Known Exploited Vulnerabilities catalog lists the CVE and points to the Gladinet release notes for the patched build.
The high EPSS values, with a current score of 0.8536 and a peak of 0.8897, align with confirmed in-the-wild exploitation prior to the April 2025 disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-9671
Vulnerability Data
Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for…
more
server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\web.config.
- CWE(s)
- KEV Date Added
- 08 April 2025
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requiring cryptographic keys to be established and managed according to defined requirements prevents developers from embedding static unchangeable keys.
Authenticator management requires secure distribution and handling of credentials, structurally discouraging hard-coded values.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure-SDLC activities such as code review and secret scanning directly prevent embedding static keys.
PR.AA-01's credential/key-management processes can reduce the incentive to embed secrets but do not address or detect hard-coded values in source code, so the weakness remains fully possible.
Data-at-rest protection policies require proper key management and therefore discourage hard-coded keys.
Data-in-transit protection similarly depends on non-hard-coded keys for encryption.
Configuration baselines and reviews can prohibit hard-coded keys in deployed artifacts.
PR.AA-02 addresses human identity proofing and per-person credential issuance at enrollment; it has no bearing on whether developers embed static credentials in software.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Education on secure configuration practices discourages technical staff from embedding or relying on hard-coded credentials in systems and applications.
Key-management controls that govern generation, rotation and protection of keys make the use of embedded hard-coded cryptographic keys less likely and easier to detect.
Explicit prohibition of hard-coded passwords and unauthenticated external services stops credentials from being embedded directly in source code.
Contractual requirements for secure coding practices and evidence of testing make it less likely that hard-coded credentials will be introduced or remain undetected in delivered code.
Requiring independent oversight and timely disabling of non-human identities makes it harder for hard-coded or long-lived credentials to remain exploitable.
Mandating immediate replacement of vendor-supplied default credentials eliminates the use of hard-coded or factory passwords that attackers can trivially obtain from documentation or firmware.