Deserialization in Yonyou U8 Cloud
CVE-2023-54398
Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doAction method, which passes raw HTTP request body data directly to ObjectInputStream.readObject() without filtering, to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.
Vulnerability class: Insecure Deserialization
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Yonyou U8 Cloud — versions 1.0, 2.0, 2.1
Weakness classification (CWE)
References
- disclosure@vulncheck.com (vendor-advisory, patch)
- disclosure@vulncheck.com (technical-description, exploit)
- disclosure@vulncheck.com (technical-description, exploit)
- disclosure@vulncheck.com (third-party-advisory)
- disclosure@vulncheck.com (product)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2023-54398?
- CVE-2023-54398 is a critical-severity vulnerability in Yonyou U8 Cloud, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2026-09-15.
- How severe is CVE-2023-54398?
- Critical severity. CVSS v3 base score is 9.8 out of 10.