[NEU] [hoch] Gladinet CentreStack: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Gladinet CentreStack ausnutzen, um beliebigen Programmcode auszuführen,SQL-Injection durchzuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.
Details
Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2607
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-543630.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all scored CVEs.
- Low exploitation riskCVE-2026-543640.25% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 17% of all scored CVEs.
- Low exploitation riskCVE-2026-543650.22% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 12% of all scored CVEs.
- Low exploitation riskCVE-2026-543660.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all scored CVEs.
- Low exploitation riskCVE-2026-543670.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 9% of all scored CVEs.
- Low exploitation riskCVE-2026-543680.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-54363 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-54364 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-54365 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-54366 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-54367 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-54368 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- highCVE-2026-54368: CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and S…nvd
- highCVE-2026-54367: CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenti…nvd
- highCVE-2026-54366: CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that all…nvd
- highCVE-2026-54365: CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespa…nvd
- mediumCVE-2026-54364: CentreStack before 17.4 contains a session variable injection vulnerability that allows unauth…nvd
- criticalCVE-2026-54363: CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unaut…nvd
Recent advisories for Gladinet CentreStack
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- criticalexploitedCVE-2025-14611: Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerabilitycisa-kev · 2025-12-15
- criticalexploitedCVE-2025-11371: Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerabi…cisa-kev · 2025-11-04
- criticalexploitedCVE-2025-30406: Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerabilitycisa-kev · 2025-04-08
More from CERT-Bund (BSI) Security Advisories
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow denial of service2026-07-31
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow Denial of Service2026-07-31
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow denial of service2026-07-31
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities2026-07-31
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow unspecified attack2026-07-31