CVE-2023-54398criticalobserved exploitationCWE-502

CVE-2023-54398: critical vulnerability in Yonyou U8 Cloud

Yonyou U8 Cloud Java Deserialization RCE via FileManageServlet

Published

Follow this CVE+ Monitor U8 Cloud

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

70Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.

ssvc Actcvss 9.3epss 1.2%
from disclosure to weapon
Published on NVDSep 15
VulnCheckSep 15
Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doAction method, which passes raw HTTP request body data directly to ObjectInputStream.readObject() without filtering, to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Yonyou · U8 Cloud
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Yonyou U8 Cloud

In the same product, most dangerous first.

CVE-2025-12344MEDIUMYonyou U8 Cloud Request Header NCloudGatewayServlet unrestricted uploadEPSS 0.3%CVE-2025-14185MEDIUMYonyou U8 Cloud AppServletService.class sql injectionEPSS 0.2%