CVE-2026-54364: 
Gladinet CentreStack vulnerability analysis and mitigation

CVE-2026-54364 is a session variable injection vulnerability in Gladinet CentreStack that allows unauthenticated remote attackers to bypass authentication and gain unauthorized access to management pages. The flaw affects all CentreStack versions before 17.4 and was disclosed on July 30, 2026, with a patch available in version 17.4. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, VulnCheck).

The root cause is improper encoding or escaping of output (CWE-116) in CentreStack's custom session serialization format. An attacker can embed newline (\n) and tab (\t) characters into a crafted AccountName parameter submitted via HTTP POST to the SelectProvider.aspx endpoint, causing the server to interpret the injected content as additional session variables. Specifically, this allows injection of a resellerid session variable, which bypasses the IsValidRSession authentication check — a logic flaw stemming from the absence of input sanitization before the parameter is incorporated into the serialized session structure (GitHub Advisory, VulnCheck).

Successful exploitation allows an unauthenticated network attacker to gain unauthorized access to CentreStack management pages, resulting in limited confidentiality and integrity impacts on the vulnerable system. An attacker with access to management interfaces could potentially view sensitive configuration data, modify settings, or pivot to further attacks against managed file-sharing infrastructure. Availability is not directly impacted by this vulnerability (GitHub Advisory, VulnCheck).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The vulnerability is rated automatable by NVD SSVC, meaning exploitation could be scripted without user interaction. The EPSS score is approximately 0.25% (17th percentile), indicating a low near-term exploitation probability. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing CentreStack instances running versions prior to 17.4 using tools like Shodan or Censys, searching for the CentreStack web interface.
2. Locate the vulnerable endpoint: Navigate to or directly target the SelectProvider.aspx endpoint on the CentreStack server (e.g., https://<target>/SelectProvider.aspx).
3. Craft the malicious payload: Construct an HTTP POST request with a manipulated AccountName parameter that embeds newline (\n) and tab (\t) characters followed by a resellerid key-value pair, exploiting the lack of sanitization in the custom session serialization format.
4. Submit the request: Send the crafted POST request to the SelectProvider.aspx endpoint without any authentication credentials.
5. Bypass authentication: The server deserializes the session data including the injected resellerid variable, causing the IsValidRSession check to evaluate as valid.
6. Access management pages: With the forged session established, navigate to restricted management pages that would otherwise require authentication (GitHub Advisory, VulnCheck).

• Network: Unexpected or anomalous HTTP POST requests to SelectProvider.aspx from unauthenticated or unknown source IPs; POST body parameters containing URL-encoded newline (%0A) or tab (%09) characters in the AccountName field.
• Logs: Web server access logs showing POST requests to /SelectProvider.aspx with unusual or oversized AccountName values; subsequent access to management pages from sessions that were not established through normal login flows.
• Application Behavior: Session records containing a resellerid variable set without a corresponding legitimate reseller login event; unexpected access to administrative or management endpoints by sessions originating from unauthenticated requests.

The primary remediation is to upgrade CentreStack to version 17.4 or later, which addresses the lack of input sanitization in the session serialization logic (GitHub Advisory, VulnCheck). As interim workarounds, administrators should implement Web Application Firewall (WAF) rules to detect and block POST requests containing newline or tab characters in the AccountName parameter targeting SelectProvider.aspx. Additionally, consider restricting access to the SelectProvider.aspx endpoint to trusted IP ranges where operationally feasible, and implement additional session validation mechanisms beyond the IsValidRSession check.