A just lately disclosed security flaw in Gladinet CentreStack additionally impacts its Triofox distant entry and collaboration answer, in keeping with Huntress, with seven totally different organizations compromised to this point.
Tracked as CVE-2025-30406 (CVSS rating: 9.0), the vulnerability refers to the usage of a hard-coded cryptographic key that would expose internet-accessible servers to distant code execution assaults.
It has been addressed in CentreStack model 16.4.10315.56368 launched on April 3, 2025. The vulnerability is claimed to have been exploited as a zero-day in March 2025, though the precise nature of the assaults is unknown.
Now, in keeping with Huntress, the weak spot additionally impacts Gladinet Triofox as much as model 16.4.10317.56372.
“By default, earlier variations of the Triofox software program have the identical hardcoded cryptographic keys of their configuration file, and might be simply abused for distant code execution,” John Hammond, principal cybersecurity researcher at Huntress, mentioned in a report.
Telemetry information gathered from its accomplice base has revealed that the CentreStack software program is put in on about 120 endpoints and that seven distinctive organizations have been affected by the exploitation of the vulnerability.
The earliest signal of compromise dates again to April 11, 2025, 16:59:44 UTC. The attackers have been noticed leveraging the flaw to obtain and sideload a DLL utilizing an encoded PowerShell script, an strategy seen in current assaults utilizing the CrushFTP flaw, adopted by conducting lateral motion and putting in MeshCentral for distant entry.
Huntress additionally mentioned the attackers have been recognized as operating Impacket PowerShell instructions to carry out numerous enumeration instructions and set up MeshAgent. That mentioned, the precise scale and the tip purpose of the campaigns are at present unknown.
In gentle of energetic exploitation, it is important that customers of Gladinet CentreStack and Triofox replace their situations to the newest model to safeguard towards potential dangers.
