Security Research

CVE-2025-30406 CentreStack Deserialization to RCE: Hard-coded Machine Key + ASP.NET ViewState Exploitation

#Vulnerability Analysis#Code Audit#Web Security
CVE-2025-30406 CentreStack Deserialization to RCE: Hard-coded Machine Key + ASP.NET ViewState Exploitation

CentreStack hard-codes ASP.NET’s MachineKey (the validation key for ViewState signing) into the product configuration — attackers only need to extract this key from the product source or binary, use ysoserial to craft a malicious ViewState, and trigger ASP.NET-side deserialization to execute arbitrary commands; the entire attack chain requires no authentication.

Unlock to view this content.