Skip to main content

CentreStack CVE-2026-54364

| EUVDEUVD-2026-51100 MEDIUM
Improper Encoding or Escaping of Output (CWE-116)
2026-07-30 VulnCheck GHSA-g6j6-rqg9-wq7x
Authentication Bypass Centrestack
6.9
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.2 HIGH

Network endpoint, no auth required, scope changes as authentication boundary is bypassed granting management access; no availability impact described.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Patch available
Jul 30, 2026 - 14:03 EUVD
Analysis Generated
Jul 30, 2026 - 13:32 vuln.today

DescriptionCVE.org

CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inject arbitrary session variables by embedding newline and tab characters into a crafted AccountName parameter posted to the SelectProvider.aspx endpoint. Attackers can exploit the lack of input sanitization in the custom session serialization format to inject a resellerid session variable, bypassing the IsValidRSession authentication check and gaining unauthorized access to management pages.

AnalysisAI

Session variable injection in Gladinet CentreStack before version 17.4 allows unauthenticated remote attackers to bypass authentication and access management pages without credentials. By embedding newline and tab characters into the AccountName parameter posted to SelectProvider.aspx, attackers exploit the absence of input sanitization in the product's custom session serialization format to inject an arbitrary resellerid session variable, which satisfies the IsValidRSession authentication check and opens management interfaces. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Send crafted POST to SelectProvider.aspx
Delivery
Embed newline/tab characters in AccountName parameter
Exploit
Inject resellerid key-value pair into session serialization
Execution
Application deserializes poisoned session state
Persist
IsValidRSession check passes on injected resellerid
Impact
Gain unauthorized access to management pages
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No special conditions are required beyond network access to a CentreStack instance running a version prior to 17.4. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) places this vulnerability in the unauthenticated, low-complexity, network-accessible category with limited confidentiality and integrity impact (VC:L/VI:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated attacker discovers an internet-exposed CentreStack portal and sends a crafted HTTP POST request to /SelectProvider.aspx with an AccountName value containing embedded newline and tab characters followed by a resellerid key-value pair conforming to the session serialization format. The server deserializes the poisoned session data, recognizes the injected resellerid variable as a valid session token, and grants the attacker access to reseller management pages without any credential check. …
Remediation Upgrade CentreStack to version 17.4 or later, which is the first version confirmed to remediate this vulnerability per the CVE description. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Centrestack

View all
CVE-2025-30406 CRITICAL POC
9.0 Apr 03

Gladinet CentreStack contains a deserialization vulnerability caused by a hardcoded machineKey in the portal, allowing u
CVE-2023-26829 CRITICAL POC
9.8 Mar 31

An authentication bypass vulnerability in the Password Reset component of Gladinet CentreStack before 13.5.9808 allows r
CVE-2023-26830 HIGH POC
7.2 Mar 31

An unrestricted file upload vulnerability in the administrative portal branding component of Gladinet CentreStack before
CVE-2026-54363 CRITICAL
9.3 Jul 30

Unauthenticated remote code execution in Gladinet CentreStack before 17.5 stems from a hardcoded cryptographic key (a st
CVE-2026-54367 HIGH
8.8 Jul 30

Authentication bypass in Gladinet CentreStack before 17.2 lets unauthenticated remote attackers read, write, and delete

CVE-2026-54365 HIGH
8.7 Jul 30

Unauthenticated OS user-account creation in Gladinet CentreStack before 17.3 lets remote attackers abuse an insecure des
CVE-2026-54368 HIGH
8.7 Jul 30

SQL injection leading to remote code execution in Gladinet CentreStack before 17.4 lets authenticated users inject arbit
CVE-2026-54366 HIGH
8.7 Jul 30

Out-of-band file exfiltration in Gladinet CentreStack before 17.4 lets unauthenticated remote attackers read arbitrary s

Same weakness CWE-116 – Improper Encoding or Escaping of Output

View all
CVE-2013-4547 HIGH POC
7.5
CVE-2026-20245 HIGH POC
7.8
CVE-2022-36446 CRITICAL POC
9.8
CVE-2017-8303 CRITICAL POC
9.8
CVE-2022-30781 HIGH POC
7.5
CVE-2023-46301 CRITICAL POC
9.8
CVE-2023-46300 CRITICAL POC
9.8
CVE-2022-41443 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-54364 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy