Technical impact
The vulnerability is a hardcoded cryptographic key flaw present in all versions of CentreStack prior to 17.5. It allows an attacker to forge encrypted authentication tokens by exploiting a static system number used as entropy in token encryption and decryption. With a forged x-glad-auth header, the attacker can invoke privileged API endpoints, such as acquiretenantbackuptoken, to obtain a domain administrator IdentityTicket. The chain of exploitation results in a fully uncontrolled code execution environment on the affected server.
Affected Systems
All installations of Gladinet CentreStack released before version 17.5 are impacted. The vulnerability exists across every deployment that has not applied the version 17.5 (or later) security update, affecting the entire product line regardless of deployment size or configuration.
Risk and Exploitability
The CVSS score of 9.3 reflects a high severity. Because the flaw requires no prior authentication, the attack is network‑based and can be performed from anywhere the API is exposed. The EPSS score is very low at < 1 %, and the vulnerability is not listed as a Known Exploited Vulnerability by CISA, but the impact and ease of exploitation warrant immediate attention. Exploitability hinges on the presence of the hardcoded key and the encryption routine; once an attacker obtains a forged token, they can move laterally within the CentreStack environment and gain administrator privileges.
