CVE-2025-12344
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A vulnerability has been found in Yonyou U8 Cloud up to 5.1sp. The impacted element is an unknown function of the file /service/NCloudGatewayServlet in the Request Header Handler component. Manipulation of the ts/sign argument leads to unrestricted upload, and the attack may be performed remotely.
Risk Assessment
A remote attacker can upload unrestricted files to the server, potentially leading to malicious code execution or system compromise. The exploit has been publicly disclosed and may be used.
Recommendation
Contact the vendor for a patch and restrict access to the /service/NCloudGatewayServlet endpoint. In the meantime, monitor for unusual file uploads and traffic to this endpoint.
Other vulnerabilities in Yonyou U8 Cloud
See all- CVE-2023-54398Critical
Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doAction method, which passes raw HTTP request body data directly to ObjectInputStream.readObject() without filtering, to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.
- CVE-2025-14185Medium
A vulnerability was identified in Yonyou U8 Cloud versions 5.0, 5.0sp, 5.1, and 5.1sp, where manipulation of the usercode argument in the file nc/pubitf/erm/mobile/appservice/AppServletService.class leads to SQL injection. The attack can be launched remotely, and the exploit is publicly available. The vendor was contacted but did not respond.
Original NVD description (English source)
A vulnerability has been found in Yonyou U8 Cloud up to 5.1sp. The impacted element is an unknown function of the file /service/NCloudGatewayServlet of the component Request Header Handler. Such manipulation of the argument ts/sign leads to unrestricted upload. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS