Gladinet Patches Exploited CentreStack Vulnerability

Gladinet has released patches for a CentreStack vulnerability that security researchers say has been exploited in the wild since at least late September. The issue, tracked as CVE-2025-11371, is an unauthenticated local file inclusion flaw that allows attackers to retrieve a machineKey and then, using a ViewState deserialization vulnerability, execute code remotely.

According to Huntress, attackers exploited the flaw to obtain the configuration file containing the machineKey and perform a deserialization attack to run commands on the affected system, with successful exploits giving attackers the privileges of the IIS application pool user. Gladinet had already addressed a related flaw, CVE-2025-30406, by patching in April and removing the hardcoded key from a configuration file.

The firm patched CentreStack version 16.10.10408.56683 to fix the newly discovered vulnerability, and organisations are advised to apply the patches promptly. The article on SecurityWeek was written by Ionut Arghire and published on 17 October 2025.