External risk intelligence

JSH_ERP Fastjson Deserialization Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-51746

JSH_ERP is an enterprise resource planning application. Such applications are commonly deployed as web-based platforms for business operations, often necessitating access from networks that may include public-facing interfaces to facilitate remote work or multi-site connectivity. The vulnerable endpoint is part of the application's web interface, which is typically reachable in standard deployments.

Deserialization

Jishenghua Jsherp

2.3.1 and earlier

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the JSH_ERP software, stemming from an issue with how it handles data. This could potentially allow unauthorized access and manipulation of the system. The main concern at this time is to confirm if our organization uses this specific software and is therefore exposed.

A critical flaw exists in the software's data handling.
Understand if this software is in use.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerable endpoint over the network without any authentication or user interaction. This endpoint, when invoked with specially crafted data, can lead to significant system compromise due to unsafe deserialization.

No authentication required.
Triggered by a network request.
Allows full system compromise.

Live Threat

Current exploitation, exposure, and threat context

The `/serialNumber/addSerialNumber` endpoint in JSH_ERP could be exploited through fastjson deserialization attacks when accessible over the network, potentially impacting the integrity and availability of the system and its data.

System data integrity and availability.
Remote unauthenticated network access.
Compromised business operations and data.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given the identified vulnerability in the JSH_ERP application, ownership likely falls to the application owners or the platform team responsible for managing ERP systems. The immediate first step is to confirm the presence of JSH_ERP instances, assess their accessibility from external networks, and determine their business criticality. Once ownership is confirmed and exposure is understood, a remediation plan can be developed based on the assessed risk.

Confirm JSH_ERP presence and criticality.
Identify the business owner.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is JSH_ERP?

JSH_ERP is an enterprise resource planning application used by businesses to manage and automate core operational processes. It typically functions as a centralized, web-based platform that coordinates data across various business activities, requiring it to be integrated into an organization's network infrastructure to support daily operations.

What does CVE-2025-51746 mean for data security?

This vulnerability is classified as CWE-502, which involves unsafe deserialization. In plain terms, the software fails to properly validate incoming data before processing it. An attacker can send malicious instructions disguised as legitimate data to the application, which the system then inadvertently executes, potentially granting unauthorized control over the server.

How is this vulnerability triggered?

The flaw is triggered when an attacker sends a specially crafted network request to the specific '/serialNumber/addSerialNumber' endpoint. Because this endpoint does not require authentication, it can be accessed directly. Note that standard, benign usage of the software that does not involve sending malicious deserialization payloads does not trigger this security issue.

Is my system at risk?

According to Halo Surface Signal, this software is often deployed as a web-based platform, making its interface reachable over a network. If your instance is accessible via the internet or an untrusted network segment, the risk is higher. You should assess whether your JSH_ERP deployment is exposed to these network paths, as the vulnerability does not require user interaction to be exploited.

What should I do if I run JSH_ERP?

Begin by auditing your environment to confirm if JSH_ERP is installed and identifying the specific version in use. Determine if the instance is reachable from external networks and evaluate its business criticality. Once you have mapped your assets and confirmed ownership, consult your internal teams to prioritize remediation plans based on the application's exposure and your organization's risk tolerance.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.