Exploited Zero-Day in Gladinet CentreStack: Rapid RCE and the Need for Zero Trust
Executive Summary
In October 2025, Gladinet patched a critical zero-day vulnerability (CVE-2025-11371) in its CentreStack file-sharing software, which had been exploited by threat actors since late September. The attackers leveraged a local file inclusion flaw to access the application's Web.config file and extract the machine key, subsequently exploiting a chained deserialization vulnerability (CVE-2025-30406) to achieve unauthenticated remote code execution. The service's SYSTEM-level privileges enabled lateral movement and sensitive file access. Gladinet released mitigations and a full patch, urging immediate client upgrades to prevent further compromise of business environments.
This incident highlights a continuing trend in targeting widely used business collaboration platforms via sophisticated vulnerability chaining, often bypassing previous mitigations. The exploitation’s speed and public proof-of-concept release underscore the growing urgency for rapid patch management and proactive threat detection across enterprise SaaS deployments.
Why This Matters Now
Zero-day vulnerabilities in business-critical software are rapidly exploited in the wild, with attackers leveraging chained flaws and published proof-of-concepts to bypass established safeguards. Organizations relying on file-sharing platforms must prioritize prompt patching and apply Zero Trust strategies to limit lateral movement and protect sensitive data.
Attack Path Analysis
Attackers exploited a zero-day local file inclusion (LFI) vulnerability in the CentreStack application to read sensitive configuration files, leading to the extraction of cryptographic keys. With these keys, they crafted malicious payloads to gain remote code execution with SYSTEM privileges. The attackers, now privileged, could move laterally in the cloud/hybrid environment by targeting additional systems or workloads and escalate their foothold. They established command and control by executing obfuscated payloads via HTTP POST requests. Data or sensitive files could then be exfiltrated, leveraging outbound traffic routes. The impact included potential compromise of business data, risk of ransomware deployment, or operational disruption.
Kill Chain Progression
Initial Compromise
Description
Attackers exploited the LFI zero-day (CVE-2025-11371) in CentreStack to retrieve the Web.config file containing the ASP.NET machine key, via unauthenticated HTTP requests.
Related CVEs
CVE-2025-11371
CVSS 7.5An unauthenticated Local File Inclusion vulnerability in Gladinet CentreStack and TrioFox allows unintended disclosure of system files, potentially leading to further exploitation.
Affected Products:
Gladinet CentreStack – <= 16.7.10368.56560
Gladinet TrioFox – <= 16.7.10368.56560
Exploit Status:
exploited in the wildCVE-2025-30406
CVSS 9.8A deserialization vulnerability in Gladinet CentreStack due to hardcoded machineKey usage allows remote code execution by attackers who know the machineKey.
Affected Products:
Gladinet CentreStack – <= 16.1.10296.56315
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Data Obfuscation
OS Credential Dumping
Command and Scripting Interpreter
Valid Accounts
Hijack Execution Flow
Exfiltration Over Alternative Protocol
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Security of System Components and Software
Control ID: 6.2.4
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 15(1)
CISA ZTMM 2.0 – Prevent Vulnerable Application Deployments
Control ID: Applications and Workload Pillar: Code Security
NIS2 Directive – Incident Handling and Response
Control ID: Article 21(2)(d)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
Zero-day exploitation of CentreStack file-sharing software exposes critical infrastructure to remote code execution, requiring immediate patching and enhanced security validation.
Financial Services
Local file inclusion vulnerability enabling system-level access threatens sensitive financial data protection and compliance with regulatory frameworks like PCI-DSS requirements.
Health Care / Life Sciences
Active exploitation bypassing security mitigations creates HIPAA compliance risks through unauthorized access to protected health information via compromised file-sharing systems.
Legal Services
CVE-2025-11371 exploitation threatens attorney-client privilege and confidential case data through compromised document sharing platforms requiring immediate security assessment and remediation.
Sources
- Gladinet fixes actively exploited zero-day in file-sharing softwarehttps://www.bleepingcomputer.com/news/security/gladinet-fixes-actively-exploited-zero-day-in-file-sharing-software/Verified
- NVD - CVE-2025-11371https://nvd.nist.gov/vuln/detail/CVE-2025-11371Verified
- NVD - CVE-2025-30406https://nvd.nist.gov/vuln/detail/CVE-2025-30406Verified
- CISA Adds Two Known Exploited Vulnerabilities to Cataloghttps://www.cisa.gov/news-events/alerts/2025/04/08/cisa-adds-two-known-exploited-vulnerabilities-catalogVerified
- Gladinet CentreStack and Triofox Local File Inclusion Flawhttps://www.huntress.com/blog/gladinet-centrestack-triofox-local-file-inclusion-flawVerified
- Gladinet Security Advisory for CVE-2025-30406https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdfVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Proper application of Zero Trust and CNSF controls—such as segmentation, policy-driven access enforcement, inline intrusion prevention, and strong egress filtering—would have raised significant barriers at each kill chain step, reducing both attacker freedom and business risk. Granular visibility and threat detection would enable rapid response to anomalous behaviors like unauthorized file access or suspicious outbound activity.
Control: Cloud Firewall (ACF)
Mitigation: Blocked unauthorized inbound traffic and exploitation attempts.
Control: Inline IPS (Suricata)
Mitigation: Detected and blocked signature-based exploit and privilege escalation payloads.
Control: Zero Trust Segmentation
Mitigation: Prevented unauthorized workload-to-workload communication and lateral movement.
Control: Threat Detection & Anomaly Response
Mitigation: Raised alerts on anomalous connections and unusual command sequences.
Control: Egress Security & Policy Enforcement
Mitigation: Blocked or alerted on unsanctioned data transfers and unauthorized egress.
Enabled rapid identification and containment of affected assets and flows.
Impact at a Glance
Affected Business Functions
- File Sharing Services
- Data Storage Management
Estimated downtime: 3 days
Estimated loss: $50,000
Potential exposure of sensitive configuration files, including cryptographic keys, leading to unauthorized access and data breaches.
Recommended Actions
Key Takeaways & Next Steps
- • Prioritize immediate patching of vulnerable applications (such as CentreStack) and routinely validate cloud app configurations.
- • Enforce granular Zero Trust segmentation with identity-based, least-privilege policies to restrict lateral movement within cloud and hybrid environments.
- • Deploy inline intrusion prevention and threat detection capabilities to detect and block deserialization and RCE exploit attempts in real time.
- • Strengthen outbound (egress) filtering and policy enforcement to prevent unauthorized data exfiltration and command & control communication.
- • Invest in unified, multi-cloud visibility and centralized policy management to accelerate detection, containment, and incident response across distributed architectures.
