CVE-2025-10394
BaseFortify
Publication date: 2025-09-14
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fcba_zzm | smart_park_management_system | 2.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-10394 is a Remote Code Execution (RCE) vulnerability in the Scheduled Task Module of the fcba_zzm ics-park Smart Park Management System version 2.0. It occurs because the system does not validate or restrict the method string specified when creating or updating scheduled tasks, specifically in the file JobController.java. An attacker with administrative access can supply arbitrary method calls, such as dangerous YAML deserialization methods, which the scheduler executes directly without security checks. This allows the attacker to inject and execute arbitrary code remotely on the server. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can lead to full remote code execution on the affected server, allowing attackers to fully compromise the system. Potential impacts include unauthorized manipulation or destruction of business data and logic, exposure of sensitive information, privilege escalation, and lateral movement within the internal network. The attacker can execute arbitrary code with the server's privileges, severely affecting the confidentiality, integrity, and availability of the system. [1, 2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious POST requests to the endpoint /api/monitor/job/save that include unusual or dangerous method strings in the invokeTarget parameter, such as calls to org.yaml.snakeyaml.Yaml.load or other unexpected method invocations. Network intrusion detection systems (NIDS) or web application firewalls (WAF) can be configured to alert on such patterns. Additionally, reviewing scheduled tasks created or updated in the system for any invokeTarget values that do not match a whitelist of safe methods can help detect exploitation attempts. Specific commands depend on your environment, but for example, you can use curl to simulate or detect suspicious requests: curl -X POST https://yourserver/api/monitor/job/save -d '{"invokeTarget":"org.yaml.snakeyaml.Yaml.load(...)"}' -H 'Content-Type: application/json'. Also, inspecting application logs for unexpected method calls or errors related to task scheduling may help identify exploitation. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include implementing a whitelist to restrict scheduled task execution only to a predefined set of safe and explicitly allowed methods, thereby preventing arbitrary method invocation. Enhance input validation and sanitization on the endpoints responsible for creating or updating scheduled tasks, especially validating the invokeTarget parameter to reject unsafe or unrecognized method strings. Users should upgrade to the latest secure version of the RuoYi framework where this vulnerability is fixed or apply official security patches once available. Until patches are applied, restrict administrative access to the scheduling module and monitor for suspicious activity related to task creation or updates. [1, 2]