Hillstone Networks

'; } else{ echo ''; } echo 'Hillstone Networks'; } elseif ($_SERVER[HTTP_HOST] == "update1.huaantech.com.cn") { echo ''; echo 'huaantech'; } elseif ($_SERVER[HTTP_HOST] == "update1.dcnetworks.com.cn") { echo ''; echo 'dcnetworks'; } elseif ($_SERVER[HTTP_HOST] == "update1.w-ibeda.com") { if (false===strpos($_SERVER[REQUEST_URI],"/en/")) echo ''; else echo ''; echo 'w-ibeda'; } elseif ($_SERVER[HTTP_HOST] == "update1.hp-telecom.com") { echo ''; echo 'hp-telecom'; } elseif ($_SERVER[HTTP_HOST] == "update1.maipu.com") { echo ''; echo 'Maipu'; } elseif ($_SERVER[HTTP_HOST] == "update1.ncurity.com") { echo ''; echo 'Ncurity'; } elseif ($_SERVER[HTTP_HOST] == "update1.socusnetwork.com") { echo ''; echo 'Socusnetwork'; } else{ echo ''; echo 'Hillstone Networks'; } ?>

vul_app:yonyou_nc_actionhandlerservlet_arbitrary_command_execution_vul（Rule ID：1070210364）

Release Date：2025/9/15

Rule Name：Yonyou NC ActionHandlerServlet Arbitrary Command Execution Vulnerability

Severity：critical

CVE ID：

Descripiton：

Yonyou NC is based on the use of cloud computing, big data, artificial intelligence and other technologies to create a digital integration platform for enterprise management. Yonyou NC ActionHandlerServlet has a deserialization vulnerability that can be exploited by an attacker to execute arbitrary commands on the server. This rule supports to defend the A6: Vulnerable and Outdated Components of OWASP Top 10 - 2021.
Other reference：None

Solution：

Update vendor patches.