CVE-2025-30406

Summary (mode C): Gladinet CentreStack and Triofox are affected by a hard-coded machineKey in web.config that enables ViewState deserialization attacks (CVE-2025-30406). The flaw allows an unauthenticated attacker to forge ViewState payloads, leading to remote code execution and has been exploite...

CVE-2025-11371

CVE-2025-11371 is an unauthenticated Local File Inclusion (LFI) exists in Gladinet CentreStack and TrioFox. Connected documents describe an LFI affecting CentreStack/TrioFox via the default installation, enabling reading of server files through the /storage/t.dn endpoint by abusing an unsafely sa...

CVE-2025-14611

CVE-2025-14611 affects Gladinet CentreStack and Triofox prior to 16.12.10420.56791. The root cause is hardcoded, static keys/IVs used by the AES cryptosystem (AES-256-CBC) in the web services, enabling attackers to forge or decrypt access tickets and potentially trigger arbitrary local file inclu...

CVE-2023-26830

CVE-2023-26830 covers an unrestricted file upload flaw in the Gladinet CentreStack administrative portal branding component, affecting versions prior to 13.5.9808 . The vulnerability allows an authenticated attacker to upload malicious files to the server and execute arbitrary code. The issue is ...

CVE-2023-26829

CVE-2023-26829 affects Gladinet CentreStack before 13.5.9808. The issue is an authentication bypass in the Password Reset component that lets remote attackers set a new password for any valid user without the previous password, resulting in full authentication bypass. Impact is authenticated acce...