Active Attacks Exploit Gladinet's Hard-Coded Keys for Unauthorized Access and Code Execution

Huntress warns of an actively exploited vulnerability in Gladinet’s CentreStack and Triofox products that stems from hard-coded cryptographic keys used to encrypt access tickets, which could allow threat actors to decrypt or forge tickets and access web.config files, enabling potential ViewState deserialization and remote code execution.

The flaw centres on a function named GenerateSecKey() in GladCtrl64.dll, which produces a constant 100‑byte key text, so the resulting keys never change and can be reused to access or forge tickets. According to Huntress, attacks have taken the form of crafted URL requests to the /storage/filesvr[.]dn endpoint, leaving Username and Password blank and effectively letting the IIS Application Pool Identity run, with a non-expiring ticket timestamp of 9999.

As of 10 December 2025, nine organisations across sectors including healthcare and technology have been affected, with activity traced to the IP address 147.124.216[.]205 and a plan to chain the CVE-2025-11371 flaw with the new exploit to obtain the machine key from web.config. Organisations are urged to update to the latest CentreStack and Triofox version, 16.12.10420.56791, and to rotate the machine key, following the recommended IIS instructions and scanning logs for the string vghpI7EToZUDIZDdprSubL3mTZ2.