CVE-2025-30406Active Exploitation(gladinet / centrestack)

Do you have mad skills 🥷and want to join the Adversary Tactics team at @HuntressLabs ? We're looking for that special someone to help lead our Rapid Response engagements. Some examples of deliverables are: * SolarWinds Web Help Desk: https://www.huntress.com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399 * React2Shell: https://www.huntress.com/blog/peerblight-linux-backdoor-exploits-react2shell * Gladinet / Triofox: https://www.huntress.com/blog/cve-2025-30406-critical-gladinet-centrestack-triofox-vulnerability-exploited-in-the-wild * CrushFTP: https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation

🔒 Private DFIR Report: ViewState of Mind, Gladinet Exploit Opens the Door In January, a threat actor gained initial access by exploiting CVE-2025-30406 on an exposed Gladinet CentreStack server, large VIEWSTATE payloads in the network traffic gave the exploitation away. Request access or a demo 👉 https://buff.ly/5OJGkqu #DFIR #ThreatIntel

🔒 Private DFIR Report: ViewState of Mind: Gladinet Exploit Opens the Door In January, we observed a threat actor gain initial access to an environment by exploiting CVE-2025-30406 on an exposed Gladinet CentreStack server. Looking at the network traffic at the time of this connection showed large VIEWSTATE payloads being sent to the server. Based on this pattern in the network traffic, the command execution from the IIS server, and the version of Gladinet CentreStack, we assessed that the threat actor successfully exploited CVE-2025-30406 for initial access in this intrusion. Private report — request access or a demo: https://thedfirreport.com/products/threat-intel/private-dfir-reports/

HuntressがGladinet CentreStack/Triofoxの重大脆弱性(CVE-2025-30406, CVSS 9.0)の実環境悪用を報告。7組織・約120端末に影響。デフォルト暗号鍵がRCEの原因。 https://www.securityweek.com/huntress-documents-in-the-wild-exploitation-of-critical-gladinet-vulnerabilities/ #Vulnerability