CVE-2025-51745
Published: 25 November 2025
Summary
CVE-2025-51745 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Jishenghua Jsherp. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly validates untrusted input to the /role/addcan endpoint, preventing malicious fastjson deserialization payloads from being processed.
Enables timely identification, reporting, and patching of the specific fastjson deserialization flaw in JSH_ERP 2.3.1.
Ensures secure baseline configuration settings for the fastjson library, such as disabling autoType, to mitigate deserialization risks.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a deserialization flaw (CWE-502) in a public-facing ERP web endpoint, enabling unauthenticated remote code execution, directly mapping to exploitation of public-facing applications.
NVD Description
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /role/addcan endpoint is vulnerable to fastjson deserialization attacks.
Deeper analysisAI
CVE-2025-51745, published on 2025-11-25, is a critical vulnerability (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) discovered in jishenghua JSH_ERP 2.3.1. The flaw affects the /role/addcan endpoint, which is vulnerable to fastjson deserialization attacks, mapped to CWE-502 (Deserialization of Untrusted Data). This Java-based ERP system processes untrusted input insecurely, enabling exploitation through malicious serialized payloads.
The vulnerability can be exploited by any remote attacker with network access to the affected endpoint, requiring no privileges, user interaction, or special conditions due to its low attack complexity. Attackers can achieve high-impact outcomes, including full compromise of confidentiality, integrity, and availability, typically resulting in remote code execution via deserialization gadget chains in fastjson.
Advisories and related resources are available at https://blog.hackpax.top/jsh-erp4/ and https://gist.github.com/Paxsizy/cd1557aeba8093a8650601c4dbffb6f9, with the project hosted on Gitee at https://gitee.com/jishenghua and https://gitee.com/jishenghua/JSH_ERP.
Details
- CWE(s)