Research · Apr 3, 2025
Critical Vulnerability Discovered in Gladinet CentreStack and Triofox
A critical deserialization vulnerability has been identified in Gladinet CentreStack, affecting versions up to 16.1.10296.56315, which can lead to remote code execution if exploited.
What changed
Gladinet CentreStack and Triofox have been found to contain a serious vulnerability related to the use of a hard-coded cryptographic key. This flaw allows attackers to exploit the system through remote code execution.
The issue arises from the hardcoded machineKey in the CentreStack portal, which has been actively exploited since March 2025.
Who is affected
The vulnerability impacts several products and their users, particularly those relying on Gladinet's solutions.
Organizations using the following are at risk:
- Gladinet CentreStack versions up to 16.1.10296.56315
- Triofox, which may share similar vulnerabilities
- Any enterprise relying on these platforms for secure file sharing and collaboration
What to do
Users of Gladinet CentreStack and Triofox are advised to take immediate action to mitigate the risks associated with this vulnerability.
It is crucial to update to the latest version to ensure protection against potential exploits.
- Upgrade to Gladinet CentreStack version 16.4.10315.56368 or later.
- Manually delete the hardcoded machineKey in the portal\web.config if immediate upgrade is not possible.
- Monitor for any unusual activity that may indicate exploitation attempts.