CVE-2026-54364: 
Gladinet CentreStack vulnerability analysis and mitigation

CVE-2026-54364 is a session variable injection vulnerability in Gladinet CentreStack that allows unauthenticated remote attackers to bypass authentication and gain unauthorized access to management pages. The flaw affects all CentreStack versions before 17.4 and was disclosed on July 30, 2026, with a patch available in version 17.4. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, VulnCheck).

The root cause is improper encoding or escaping of output in CentreStack's custom session serialization format (CWE-116). An attacker can embed newline (\n) and tab (\t) characters into a crafted AccountName parameter submitted via HTTP POST to the SelectProvider.aspx endpoint, causing the application to interpret the injected content as additional session variables. Specifically, this allows injection of a resellerid session variable, which is then trusted by the IsValidRSession authentication check, effectively bypassing it without any credentials. No user interaction or special privileges are required, making the attack fully automatable over the network (GitHub Advisory, VulnCheck).

Successful exploitation allows unauthenticated attackers to gain unauthorized access to CentreStack management pages by bypassing the IsValidRSession authentication check. The impact includes low-level confidentiality and integrity compromise of the vulnerable system — attackers may read sensitive management data and perform unauthorized administrative actions. Availability is not directly impacted, but unauthorized management access could facilitate further attacks such as configuration changes, data exfiltration, or privilege escalation within the platform (GitHub Advisory, VulnCheck).

1. Reconnaissance: Identify internet-facing CentreStack instances running versions prior to 17.4 using tools like Shodan or Censys, searching for the CentreStack web interface (typically IIS-hosted ASP.NET applications).
2. Locate the vulnerable endpoint: Navigate to or directly target the SelectProvider.aspx endpoint on the CentreStack server (e.g., https://<target>/SelectProvider.aspx).
3. Craft the malicious POST request: Construct an HTTP POST request to SelectProvider.aspx with a crafted AccountName parameter that embeds newline (\n) and tab (\t) characters followed by the injected session variable, e.g., AccountName=legitimate_account%0A%09resellerid=<value>.
4. Inject the session variable: Submit the crafted request; the server's custom session deserialization logic parses the injected characters as session variable delimiters, adding resellerid to the session state.
5. Bypass authentication: Subsequent requests to protected management pages pass the IsValidRSession check because the injected resellerid session variable satisfies the authentication condition.
6. Access management pages: Navigate to restricted administrative pages to enumerate configuration, user data, or perform unauthorized administrative actions (GitHub Advisory, VulnCheck).

• Network: Unexpected HTTP POST requests to SelectProvider.aspx containing URL-encoded newline (%0A, %0D) or tab (%09) characters in the AccountName parameter; unauthenticated access attempts to management pages immediately following a SelectProvider.aspx POST.
• Logs: IIS/web server access logs showing POST requests to /SelectProvider.aspx with anomalous AccountName values containing control characters; subsequent requests to administrative endpoints from the same session/IP without a prior valid login flow.
• File System: No specific file artifacts expected from this authentication bypass alone, but monitor for new files or configuration changes in the CentreStack installation directory following unauthorized management access.
• Process/Application: ASP.NET session logs or application event logs showing resellerid session variable being set from unauthenticated requests; unexpected administrative operations (user creation, configuration changes) in CentreStack audit logs with no corresponding authenticated user session.

The primary remediation is to upgrade CentreStack to version 17.4 or later, which addresses the session variable injection vulnerability (GitHub Advisory). As interim workarounds, administrators should implement input sanitization to strip or reject newline and tab characters in the AccountName parameter, and deploy Web Application Firewall (WAF) rules to detect and block POST requests to SelectProvider.aspx containing URL-encoded control characters (%0A, %0D, %09). Additionally, consider adding supplementary session validation mechanisms beyond the IsValidRSession check to reduce reliance on a single authentication control.