CentreStack prior to version 17.3 includes an unauthenticated deserialization flaw in GSNamespace.dll that permits attackers to craft a base64‑encoded XML payload and send it to API endpoints jsonimportuserbyupn, jsonimportuserbyupnex, or japiimportuserbyupn. The payload is processed by InternalImportAdUserByUPN(), which calls the Windows NetUserAdd API with attacker‑supplied credentials, creating arbitrary local operating‑system user accounts. This bypasses authentication checks (CWE‑306) and can allow an attacker to add accounts with elevated privileges on the host.

All installations of Gladinet CentreStack with a version lower than 17.3 are affected. The vulnerability is present in any build of CentreStack that includes GSNamespace.dll before the 17.3 release.

The CVSS score of 8.7 indicates a high‑severity flaw. The EPSS score of less than 1% suggests that exploitation of this vulnerability is currently unlikely, and the vulnerability is not listed in CISA’s KEV catalog, reducing the immediate threat level. However, because the flaw is remotely exploitable without authentication, an attacker could trigger it from any network that has access to the exposed API endpoints. If successful, the attacker could create new local user accounts, potentially with administrative rights, yielding local privilege escalation and further compromise of the system.