Executive brief
CentreStack, a file-sharing and remote access platform used by managed service providers, contains a security flaw where a secret key used to protect user sessions is the same across all installations. An unauthorized attacker can use this knowledge to create their own administrative credentials, granting them full control over the system. This could lead to the theft of sensitive client data, complete service disruption, and the ability to execute malicious commands on the server.
Technical details
CentreStack versions prior to 17.5 utilize a hardcoded cryptographic key derived from a static 'SysNumber' value used as entropy for the AccessTicket.Encrypt() and AccessTicket.Decrypt() functions. Because this value is identical across all installations, an unauthenticated remote attacker can forge valid 'x-glad-auth' headers. By leveraging these forged headers, an attacker can access privileged API endpoints, such as 'acquiretenantbackuptoken', to obtain a domain administrator IdentityTicket. This sequence allows for a complete authentication bypass and subsequent remote code execution (RCE) on the affected server. The vulnerability is classified as CWE-321 (Use of Hard-coded Cryptographic Key).
Affected products
- Gladinet CentreStack before 17.5
Timeline
- 2026-07-30: advisory: Vulnerability disclosed by VulnCheck and NVD
- 2026-07-30: patched: Fixed in version 17.5