CVE-2023-54398
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doAction method, which passes raw HTTP request body data directly to ObjectInputStream.readObject() without filtering, to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.
Risk Assessment
This vulnerability allows unauthenticated attackers to achieve remote code execution on the server, potentially leading to full system compromise and backdoor installation.
Recommendation
Apply patches for Yonyou U8 Cloud that filter deserialization input in the FileManageServlet component, and restrict access to it from untrusted networks.
Other vulnerabilities in Yonyou U8 Cloud
See all- CVE-2025-14185Medium
A vulnerability was identified in Yonyou U8 Cloud versions 5.0, 5.0sp, 5.1, and 5.1sp, where manipulation of the usercode argument in the file nc/pubitf/erm/mobile/appservice/AppServletService.class leads to SQL injection. The attack can be launched remotely, and the exploit is publicly available. The vendor was contacted but did not respond.
- CVE-2025-12344Medium
A vulnerability has been found in Yonyou U8 Cloud up to 5.1sp. The impacted element is an unknown function of the file /service/NCloudGatewayServlet in the Request Header Handler component. Manipulation of the ts/sign argument leads to unrestricted upload, and the attack may be performed remotely.
Original NVD description (English source)
Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doAction method, which passes raw HTTP request body data directly to ObjectInputStream.readObject() without filtering, to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS