Centrestack
Monthly
SQL injection leading to remote code execution in Gladinet CentreStack before 17.4 lets authenticated users inject arbitrary SQL through the x-glad-filter HTTP header handled by the jsondir API endpoint. Because the injected query runs on the PostgreSQL backend, attackers chain lo_from_bytea() and lo_export() to write arbitrary files onto the server filesystem, converting a database flaw into full code execution. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Gladinet CentreStack before 17.2 lets unauthenticated remote attackers read, write, and delete arbitrary account settings by hitting API endpoints that lack authorization checks (CWE-306). Because a static shared encryption key is used to generate valid encrypted EntAcctId values, an attacker can forge identifiers for any user GUID - including the system-wide cluster settings account - to enumerate hosted tenant domains and administrator identities. There is no public exploit identified at time of analysis, but the flaw was surfaced by VulnCheck and requires no authentication.
Out-of-band file exfiltration in Gladinet CentreStack before 17.4 lets unauthenticated remote attackers read arbitrary server files by abusing an XML External Entity (XXE) flaw in the SharePoint StorageConfig handler. By pointing the storage configuration at a malicious URL, an attacker forces the server to parse attacker-controlled XML with external DTD references and leak sensitive files such as Web.config, exposing database credentials and cryptographic key material. Reported by VulnCheck; no public exploit identified at time of analysis, and the CVSS 4.0 base score is 8.7 (High).
Unauthenticated OS user-account creation in Gladinet CentreStack before 17.3 lets remote attackers abuse an insecure deserialization path in GSNamespace.dll to add arbitrary local Windows accounts. By posting a crafted base64-encoded XML StorageConfigure value to the exposed jsonimportuserbyupn/jsonimportuserbyupnex/japiimportuserbyupn endpoints, an attacker (no credentials, per CVSS PR:N) drives InternalImportAdUserByUPN() to call NetUserAdd with attacker-chosen credentials and to create arbitrary server directories. No public exploit identified at time of analysis and it is not in CISA KEV, but the same product family has a prior history of actively exploited flaws, so weight this accordingly.
Unauthenticated remote code execution in Gladinet CentreStack before 17.5 stems from a hardcoded cryptographic key (a static SysNumber used as entropy for AccessTicket.Encrypt/Decrypt across all installations), letting attackers forge valid x-glad-auth headers, invoke privileged endpoints like acquiretenantbackuptoken, and escalate to a domain administrator IdentityTicket for full server takeover. Reported by VulnCheck and carrying a CVSS 4.0 base of 9.3, it is remotely exploitable against default configurations with no authentication or user interaction. No public exploit code or CISA KEV listing is confirmed in the provided data, so at time of analysis there is no public exploit identified.
Gladinet CentreStack contains a deserialization vulnerability caused by a hardcoded machineKey in the portal, allowing unauthenticated remote code execution through crafted ViewState payloads.
Session variable injection in Gladinet CentreStack before version 17.4 allows unauthenticated remote attackers to bypass authentication and access management pages without credentials. By embedding newline and tab characters into the AccountName parameter posted to SelectProvider.aspx, attackers exploit the absence of input sanitization in the product's custom session serialization format to inject an arbitrary resellerid session variable, which satisfies the IsValidRSession authentication check and opens management interfaces. No public exploit has been identified at time of analysis, though VulnCheck discovered and reported this issue with sufficient detail to facilitate reproduction.
An unrestricted file upload vulnerability in the administrative portal branding component of Gladinet CentreStack before 13.5.9808 allows authenticated attackers to execute arbitrary code by. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An authentication bypass vulnerability in the Password Reset component of Gladinet CentreStack before 13.5.9808 allows remote attackers to set a new password for any valid user account, without. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection leading to remote code execution in Gladinet CentreStack before 17.4 lets authenticated users inject arbitrary SQL through the x-glad-filter HTTP header handled by the jsondir API endpoint. Because the injected query runs on the PostgreSQL backend, attackers chain lo_from_bytea() and lo_export() to write arbitrary files onto the server filesystem, converting a database flaw into full code execution. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Gladinet CentreStack before 17.2 lets unauthenticated remote attackers read, write, and delete arbitrary account settings by hitting API endpoints that lack authorization checks (CWE-306). Because a static shared encryption key is used to generate valid encrypted EntAcctId values, an attacker can forge identifiers for any user GUID - including the system-wide cluster settings account - to enumerate hosted tenant domains and administrator identities. There is no public exploit identified at time of analysis, but the flaw was surfaced by VulnCheck and requires no authentication.
Out-of-band file exfiltration in Gladinet CentreStack before 17.4 lets unauthenticated remote attackers read arbitrary server files by abusing an XML External Entity (XXE) flaw in the SharePoint StorageConfig handler. By pointing the storage configuration at a malicious URL, an attacker forces the server to parse attacker-controlled XML with external DTD references and leak sensitive files such as Web.config, exposing database credentials and cryptographic key material. Reported by VulnCheck; no public exploit identified at time of analysis, and the CVSS 4.0 base score is 8.7 (High).
Unauthenticated OS user-account creation in Gladinet CentreStack before 17.3 lets remote attackers abuse an insecure deserialization path in GSNamespace.dll to add arbitrary local Windows accounts. By posting a crafted base64-encoded XML StorageConfigure value to the exposed jsonimportuserbyupn/jsonimportuserbyupnex/japiimportuserbyupn endpoints, an attacker (no credentials, per CVSS PR:N) drives InternalImportAdUserByUPN() to call NetUserAdd with attacker-chosen credentials and to create arbitrary server directories. No public exploit identified at time of analysis and it is not in CISA KEV, but the same product family has a prior history of actively exploited flaws, so weight this accordingly.
Unauthenticated remote code execution in Gladinet CentreStack before 17.5 stems from a hardcoded cryptographic key (a static SysNumber used as entropy for AccessTicket.Encrypt/Decrypt across all installations), letting attackers forge valid x-glad-auth headers, invoke privileged endpoints like acquiretenantbackuptoken, and escalate to a domain administrator IdentityTicket for full server takeover. Reported by VulnCheck and carrying a CVSS 4.0 base of 9.3, it is remotely exploitable against default configurations with no authentication or user interaction. No public exploit code or CISA KEV listing is confirmed in the provided data, so at time of analysis there is no public exploit identified.
Gladinet CentreStack contains a deserialization vulnerability caused by a hardcoded machineKey in the portal, allowing unauthenticated remote code execution through crafted ViewState payloads.
Session variable injection in Gladinet CentreStack before version 17.4 allows unauthenticated remote attackers to bypass authentication and access management pages without credentials. By embedding newline and tab characters into the AccountName parameter posted to SelectProvider.aspx, attackers exploit the absence of input sanitization in the product's custom session serialization format to inject an arbitrary resellerid session variable, which satisfies the IsValidRSession authentication check and opens management interfaces. No public exploit has been identified at time of analysis, though VulnCheck discovered and reported this issue with sufficient detail to facilitate reproduction.
An unrestricted file upload vulnerability in the administrative portal branding component of Gladinet CentreStack before 13.5.9808 allows authenticated attackers to execute arbitrary code by. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An authentication bypass vulnerability in the Password Reset component of Gladinet CentreStack before 13.5.9808 allows remote attackers to set a new password for any valid user account, without. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.