Centrestack
Vendor:
First CVE: Mar 31, 2023 · Active for 3 years
5
Total CVEs
More Total CVEs than 79% of tracked products
2.5
Avg CVEs / Year
Higher CVE frequency than 77% of tracked products
8.8
Avg CVSS
Higher Avg CVSS than 83% of tracked products
60.0%
KEV Rate
Higher KEV Rate than 99% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Centrestack over time
Volume of CVEsAvg CVSS Base Score
First CVE
Mar 31, 2023
3 years ago
Most Recent CVE
Dec 12, 2025
228 days ago
CVE Severity & Scoring
Centrestack5 CVEs
40%
60%
All CVEs353,240 CVEs
45%
40%
11%
HighCritical
Attack Vector
Local0 (0.0%)
Network5 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low5 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None5 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low0 (0.0%)
High1 (20.0%)
None4 (80.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-11371HIGH In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system | Oct 9, 2025 | 7.5 | 98 | YES | YES |
CVE-2025-30406CRITICAL Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited | Apr 3, 2025 | 9.8 | 98 | YES | YES |
CVE-2025-14611CRITICAL Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public expose | Dec 12, 2025 | 9.8 | 96 | YES | YES |
CVE-2023-26829CRITICAL An authentication bypass vulnerability in the Password Reset component of Gladinet CentreStack before 13.5.9808 allows remote attackers to set a new password for any valid user acc | Mar 31, 2023 | 9.8 | 31 | NO | NO |
CVE-2023-26830HIGH An unrestricted file upload vulnerability in the administrative portal branding component of Gladinet CentreStack before 13.5.9808 allows authenticated attackers to execute arbitra | Mar 31, 2023 | 7.2 | 19 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (5 CVEs).
CISA KEV
3 CVEs
60.0% of CVEs· 99th percentile
Metasploit
3 CVEs
60.0% of CVEs· 99th percentile
Nuclei
3 CVEs
60.0% of CVEs· 99th percentile
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (5 CVEs).
Media Mentions
Signals from CVEs in this product scope (5 CVEs).
Top CNAs Publishing CVEs For Centrestack
Top CWEs
Versions
No cataloged versions.