Full Report
Hackers exploited a vulnerability in Gladinet CentreStack's secure file-sharing software as a zero-day since March to breach storage servers [...]
Analysis Summary
# Vulnerability: CentreStack Remote Code Execution (RCE) Exploited in the Wild
## CVE Details
- CVE ID: CVE-2025-30406 (Inferred based on context, as the exact CVE in the truncated text refers to an older issue but the description is clearly about a new, exploited CentreStack RCE)
* *Note: The provided text references patching instructions related to `machineKey` rotation, which is often associated with cryptographic/config vulnerabilities. The surrounding context strongly suggests a modern RCE actively exploited against CentreStack.*
- CVSS Score: N/A (Score not explicitly provided in the summary, but exploitation status indicates High Severity)
- CWE: N/A (Specific CWE not mentioned)
## Affected Systems
- Products: CentreStack (File sharing servers)
- Versions: All versions prior to remediation (Specific vulnerable versions not detailed, but immediate updates are urged).
- Configurations: Applicable to deployments running CentreStack, especially those in multi-server setups.
## Vulnerability Description
A critical vulnerability, confirmed to be exploited as a zero-day, exists within CentreStack file sharing environments that allows for Remote Code Execution (RCE). The underlying cause appears related to improper management or cryptographic key handling, as mitigation involves manually rotating the `machineKey` in the `root\web.config` and `portal\web.config` files. Successful exploitation allows attackers to compromise file-sharing servers.
## Exploitation
- Status: Mentioned as exploited in the wild, specifically noted by CISA's inclusion in the KEV catalog.
- Complexity: Likely Low to Medium, given the widespread nature of attacks potentially leveraging file-sharing expertise (e.g., Clop group).
- Attack Vector: Network (as it targets a file-sharing server infrastructure).
## Impact
- Confidentiality: High (Likely data theft based on threat actor history)
- Integrity: High (Potential for unauthorized code execution and system modification)
- Availability: Medium/High (System compromise can lead to denial of service or data destruction)
## Remediation
### Patches
- Update to the patched version provided by Gladinet immediately. (Specific patch version number not detailed in the source text).
### Workarounds
- **MachineKey Rotation:** Customers unable to update immediately must manually rotate the `machineKey` value in both configuration files:
1. `root\web.config`
2. `portal\web.config`
- **Consistency:** For multi-server deployments, ensure the newly rotated `machineKey` values are consistent across *all* nodes.
- **Apply Changes:** Restart IIS services after performing the machine key rotation for the mitigation to take effect.
## Detection
- **Indicator of Compromise (IOC):** Not explicitly detailed, but monitoring for unexpected code execution or modifications to application configuration files (`web.config`) is crucial.
- **Detection Methods and Tools:** Organizations should monitor network connections targeting the CentreStack servers for suspicious activity associated with RCE or post-exploitation behavior, similar to recent attacks targeting other MFT solutions (Clop activity profile).
## References
- Vendor Advisory: gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdf (Defanged)
- CISA KEV Catalog: cisa.gov/known-exploited-vulnerabilities-catalog (Defanged)
- Contextual Threat History (Clop Targets):
- bleepingcomputer.com/news/security/clop-ransomware-claims-responsibility-for-cleo-data-theft-attacks/ (Defanged)
- bleepingcomputer.com/news/security/clop-ransomware-claims-responsibility-for-moveit-extortion-attacks/ (Defanged)
- bleepingcomputer.com/news/security/clop-ransomware-claims-it-breached-130-orgs-using-goanywhere-zero-day/ (Defanged)
- bleepingcomputer.com/news/security/clop-gang-exploiting-solarwinds-serv-u-flaw-in-ransomware-attacks/ (Defanged)
- bleepingcomputer.com/news/security/global-accellion-data-breaches-linked-to-clop-ransomware-gang/ (Defanged)