CVE-2025-30406Vulnerability
Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 10 months ago
Fix due 29 Apr 2025
Used by ransomware: not knownCISA KEV catalogue
higher than 99% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
6 reports, newest first · the exact sentence from each-
Gladinet CentreStack/Triofox: Cryptography Vulnerability“…e observed 146.70.134.50 as the malicious IP address that began the attack leveraging the ViewState deserialization vulnerability by CVE-2025-30406.”
-
PeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182“…stranger to deserialization vulnerabilities, having encountered them in April with a critical Gladinet CentreStack and Triofox flaw (CVE-2025-30406).”
-
Active Exploitation of Gladinet CentreStack and Triofox“In April 2025, Huntress published its findings on the exploitation of CVE-2025-30406, a critical-severity flaw in Gladinet CentreStack and Triofox products.”
-
Top Cyber Threat Trends of 2025: Deepfakes, ClickFix & More“In April, threat actors targeted ViewState while exploiting critical flaws in the Gladinet CentreStack and Triofox flaw (CVE-2025-30406).”
-
Do Tigers Really Change Their Stripes?“On 4 April 2025, the CrushFTP CVE-2025-31161 Auth Bypass and Post-Exploitation blog was published, and on 14 April 2025, the CVE-2025-30406 - Critical Gladinet CentreStack & Triofox Vulnerability Exploited in the Wild blog was published.”
-
CVE-2025-30406: Gladinet CentreStack & Triofox Exploited“CVE-2025-30406: Gladinet CentreStack & Triofox Exploited”
Indicators reported together
named in the same reports- 2.58.56[.]16in 2 reports
- rtb.mftadsrvr[.]comin 2 reports
- 38.165.44[.]205in 1 report
- hxxp://38.165.44[.]205/1in 1 report
- 45.76.155[.]14in 1 report
- api.qtss[.]ccin 1 report
- hxxp://185.196.11[.]207:8000/conqueror.exein 1 report
- 185.196.11[.]207in 1 report
- hxxp://185.196.11[.]207:8000in 1 report
- e9fa82d92d826c6a…4393be64b5a5in 1 report
- 146.70.134[.]50in 1 report
- 147.124.216[.]205in 1 report
- hxxp://207.148.79[.]178:6608/sys.shin 1 report
- 207.148.79[.]178in 1 report
Copy these 14 indicators · defanged
Also named with it: CVE-2025-31161, CVE-2025-11371, CVE-2025-55182, CVE-2025-53690, CVE-2025-14611, CVE-2025-66478
Thanks — we review every report.