CVE-2025-34039
Awaiting Analysis Awaiting Analysis - Queue
BaseFortify

Publication date: 2025-06-24

Last updated on: 2025-11-20

Assigner: VulnCheck

Description
A code injection vulnerability exists in Yonyou UFIDA NC v6.5 and prior due to the exposure of the BeanShell testing servlet (bsh.servlet.BshServlet) without proper access controls. The servlet allows unauthenticated remote attackers to execute arbitrary Java code via the bsh.script parameter. This can be exploited to run system commands and ultimately gain full control over the target server. The issue is rooted in a third-party JAR component bundled with the application, and the servlet is accessible without authentication on vulnerable installations.Β Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-06-24
Last Modified
2025-11-20
Generated
2026-05-07
AI Q&A
2025-06-24
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Currently, no data is known.
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is a critical code injection flaw in Yonyou UFIDA NC version 6.5 and earlier. It arises because the BeanShell testing servlet (bsh.servlet.BshServlet) is exposed without proper access controls, allowing unauthenticated remote attackers to execute arbitrary Java code by sending malicious commands via the bsh.script parameter. This enables attackers to run system commands remotely and gain full control over the affected server. [1, 2]


How can this vulnerability impact me? :

Exploitation of this vulnerability can lead to remote code execution with the highest system privileges without requiring any authentication or user interaction. An attacker can execute arbitrary system commands, potentially taking full control of the target server, compromising confidentiality, integrity, and availability of the system and its data. [1, 2]


How can this vulnerability be detected on my network or system? Can you suggest some commands?

The vulnerability can be detected by checking for the presence and accessibility of the BeanShell testing servlet at the endpoint /servlet/~ic/bsh.servlet.BshServlet. Detection can be automated by sending POST requests to this endpoint with the parameter bsh.script containing commands to execute system commands, such as exec("whoami"); on Linux or exec("ipconfig"); on Windows. Indicators of successful detection include responses containing "uid=" on Linux or "Windows IP" on Windows. Tools like nuclei can be used with specific YAML templates to automate this detection. [2]


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart