Critical Vulnerability in Gladinet CentreStack and Triofox Exposes Systems to Remote Code Execution

What changed

Gladinet CentreStack versions up to 16.1.10296.56315 are affected by a critical deserialization vulnerability stemming from the use of a hard-coded machineKey. This vulnerability has been actively exploited since March 2025, allowing attackers with knowledge of the machineKey to execute arbitrary code on the server.

The vulnerability has been addressed in version 16.4.10315.56368, which is crucial for users to implement to mitigate risks.

Who is affected

Organizations utilizing Gladinet CentreStack or Triofox are at significant risk due to this vulnerability. The following groups are particularly impacted:

Administrators and users of Gladinet CentreStack versions prior to the fixed release, as they may be susceptible to remote code execution attacks.

• Gladinet CentreStack users (versions up to 16.1.10296.56315)
• Triofox users relying on the same underlying technology
• Organizations with sensitive data hosted on these platforms
• IT security teams managing Gladinet products

What to do

Immediate action is required to secure affected systems. Users should upgrade to the patched version 16.4.10315.56368 to eliminate the vulnerability.

Additionally, administrators are advised to manually delete the hard-coded machineKey from the portal's web.config file to further enhance security.

• Upgrade Gladinet CentreStack to version 16.4.10315.56368 or later.
• Remove the hard-coded machineKey from portal\web.config.
• Monitor systems for any unauthorized access attempts.
• Review security policies to ensure robust configurations are in place.