Deserialization in Yonyou U8 Cloud
CVE-2023-54398
Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doAction method, which passes raw HTTP request body data directly to ObjectInputStream.readObject() without filtering, to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.
Vulnerability class: Insecure Deserialization
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.012 (68.1th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 68th percentile — 68.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.012 · change: +0.006
Affected products
- Yonyou U8 Cloud — versions 1.0, 2.0, 2.1
Weakness classification (CWE)
References
- security.yonyou.com/ (vendor-advisory, patch)
- cn-sec.com/archives/2182384.html (technical-description, exploit)
- blog.csdn.net/qq_41904294/article/details/134277353 (technical-description, exploit)
- avd.aliyun.com/detail (third-party-advisory)
- www.yonyou.com/Global/ (product)
- www.vulncheck.com/advisories/yonyou-u8-cloud-java-deserialization-rce-via-filem… (third-party-advisory)
Frequently asked questions
- What is CVE-2023-54398?
- CVE-2023-54398 is a critical-severity vulnerability in Yonyou U8 Cloud, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2026-09-15.
- How severe is CVE-2023-54398?
- Critical severity. CVSS v3 base score is 9.8 out of 10.