'; } else{ echo ''; } echo 'Hillstone Networks'; } elseif ($_SERVER[HTTP_HOST] == "update1.huaantech.com.cn") { echo ''; echo 'huaantech'; } elseif ($_SERVER[HTTP_HOST] == "update1.dcnetworks.com.cn") { echo ''; echo 'dcnetworks'; } elseif ($_SERVER[HTTP_HOST] == "update1.w-ibeda.com") { if (false===strpos($_SERVER[REQUEST_URI],"/en/")) echo ''; else echo ''; echo 'w-ibeda'; } elseif ($_SERVER[HTTP_HOST] == "update1.hp-telecom.com") { echo ''; echo 'hp-telecom'; } elseif ($_SERVER[HTTP_HOST] == "update1.maipu.com") { echo ''; echo 'Maipu'; } elseif ($_SERVER[HTTP_HOST] == "update1.ncurity.com") { echo ''; echo 'Ncurity'; } elseif ($_SERVER[HTTP_HOST] == "update1.socusnetwork.com") { echo ''; echo 'Socusnetwork'; } else{ echo ''; echo 'Hillstone Networks'; } ?>
 
   
 

vul_app:kingdee_cloud_k3_api_common.kdsvc_deserialization_vulnerability（Rule ID：1070210447）

Release Date：2025/9/15

Rule Name：Kingdee Cloud K3 API common.kdsvc Deserialization Vulnerability

Severity：critical

CVE ID：

 

Descripiton：

Kingdee Cloud is a cloud-based enterprise resource management (ERP) software that provides enterprises with integrated solutions for financial management, supply chain management and business process management. Since the binary data format is adopted by default in the data communication of Kingdi Cloud, it needs to be serialized and deserialized. In this process, the data is not signed or verified. As a result, the data sent by the client can be maliciously tampered by the attacker, and the serialized data containing malicious code is written to achieve the effect of remote command execution on the server side. This rule supports to defend the A6: Vulnerable and Outdated Components of OWASP Top 10 - 2021.
Other reference：None

 

Solution：

Update vendor patches.