Critical CISA Vulnerabilities: CVE-2025-30406 and CVE-2025-29824 You Need to Fix Now

The Cybersecurity and Infrastructure Security Agency (CISA) has recently expanded its Known Exploited Vulnerabilities Catalog by adding two critical vulnerabilities: CVE-2025-30406 and CVE-2025-29824. These vulnerabilities have been actively exploited, posing significant risks to organizations.

CVE-2025-30406: Gladinet CentreStack Hard-coded Cryptographic Key Vulnerability​

Gladinet CentreStack, a cloud storage solution, has been identified with a deserialization vulnerability due to a hardcoded machineKey in the portal\web.config file. This flaw allows attackers who know the machineKey to create serialized payloads that can be deserialized on the server, potentially leading to remote code execution. The vulnerability affects versions up to 16.1.10296.56315 and has been assigned a CVSS score of 9.0, indicating a critical risk.
Impact:

• Remote code execution on the CentreStack server.
• Compromise of system integrity and availability.
• Unauthorized access to sensitive data.

Mitigation:

• Upgrade to Gladinet CentreStack version 16.4.10315.56368 or later.
• Manually delete the machineKey defined in portal\web.config.
• Implement network segmentation to limit external access to the CentreStack portal.
• Review and rotate all cryptographic keys.
• Monitor for suspicious deserialization activities.

CVE-2025-29824: Microsoft Windows CLFS Driver Use-After-Free Vulnerability​

A use-after-free vulnerability has been discovered in the Microsoft Windows Common Log File System (CLFS) driver. This flaw allows local attackers to escalate privileges to SYSTEM level by exploiting specific functions within the CLFS driver. The vulnerability has been actively exploited in the wild, highlighting its severity.
Impact:

• Elevation of privileges to SYSTEM level.
• Potential for complete system compromise.
• Increased risk of further exploitation within the network.

Mitigation:

• Apply the latest security patches provided by Microsoft.
• Monitor systems for signs of exploitation, such as unexpected behavior or unauthorized access.
• Implement endpoint detection and response solutions to identify and mitigate exploitation attempts.

CISA's Recommendations​

CISA emphasizes the importance of timely remediation of these vulnerabilities to protect against active threats. While the Binding Operational Directive (BOD) 22-01 mandates Federal Civilian Executive Branch (FCEB) agencies to address these vulnerabilities by specified due dates, CISA strongly urges all organizations to prioritize the remediation of cataloged vulnerabilities as part of their vulnerability management practices.

Conclusion​

The addition of CVE-2025-30406 and CVE-2025-29824 to CISA's Known Exploited Vulnerabilities Catalog underscores the critical nature of these flaws. Organizations must act swiftly to mitigate these vulnerabilities to safeguard their systems and data from potential exploitation.

---

Source: www.cisa.gov CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA