Hackers exploit Gladinet CentreStack cryptographic flaw in RCE attacks
Source Reddit InfoSec News
Rated by Threat Radar
Data as of 12 Dec 2025, 04:15 UTC
What to do
AI-suggested
Organizations should implement immediate compensating controls such as isolating CentreStack servers within segmented network zones and restricting access to trusted IP addresses. Continuous monitoring for anomalous activity related to CentreStack processes and network traffic should be established using advanced endpoint detection and response (EDR) and network intrusion detection systems (NIDS). Until official patches are released, consider disabling or limiting CentreStack functionalities that involve cryptographic operations or remote access. Conduct thorough audits of CentreStack deployments to identify exposure and apply strict access controls and multi-factor authentication (MFA) for administrative interfaces. Engage with Gladinet support channels for updates and verify the integrity of CentreStack binaries. Additionally, prepare incident response plans specific to this vulnerability, including containment and recovery procedures. Regularly update threat intelligence feeds to detect emerging exploit attempts targeting this flaw.
Description
A cryptographic vulnerability in Gladinet CentreStack has been exploited by hackers to achieve remote code execution (RCE). This flaw allows attackers to execute arbitrary code on affected systems, potentially compromising confidentiality, integrity, and availability. Although no known exploits in the wild have been confirmed yet, the threat is considered high severity due to the nature of RCE and the critical role CentreStack plays in file sharing and cloud storage. European organizations using CentreStack are at risk, especially those in sectors reliant on secure file collaboration. Mitigation requires immediate patching once available, network segmentation, and monitoring for suspicious activity related to CentreStack services. Countries with significant cloud service adoption and digital infrastructure, such as Germany, France, and the UK, are likely to be most affected. The threat severity is assessed as high given the potential impact and ease of exploitation without authentication. Defenders should prioritize detection and containment strategies while awaiting official patches.