What is the CVSS score of CVE-2025-60828?

CVE-2025-60828 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for CVE-2025-60828?

Yes, a public proof-of-concept exploit is available for CVE-2025-60828. Prioritise patching immediately. EPSS: 0.3%.

WukongCRM CVE-2025-60828

MEDIUM

Deserialization of Untrusted Data (CWE-502)

2025-10-08 cve@mitre.org

Java Deserialization Wukong Crm

6.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable fastjson deserialization with a public POC warrants C:H/I:H/A:H; C:N/I:L/A:L in source CVSS likely reflects a partial-impact demonstration, not the exploitability ceiling.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 15:16 vuln.today

CVE Published

Oct 08, 2025 - 14:15 cve.org

MEDIUM 6.5

DescriptionCVE.org

WukongCRM-9.0-JAVA was discovered to contain a fastjson deserialization vulnerability via the /OaExamine/setOaExamine interface.

AnalysisAI

Unauthenticated fastjson deserialization in WukongCRM 9.0 (Java edition) via the /OaExamine/setOaExamine HTTP endpoint allows remote attackers to supply attacker-controlled class references that the Alibaba fastjson library instantiates at runtime, enabling arbitrary Java gadget-chain execution. A public proof-of-concept is available on GitHub, lowering the exploitation bar considerably. While the assigned CVSS scores impact conservatively at I:L/A:L with no confidentiality loss, this is inconsistent with the well-documented RCE potential of fastjson deserialization gadget chains - the actual impact may be understated. No public exploit has been confirmed as actively exploited (not in CISA KEV).

Technical ContextAI

WukongCRM is a Java-based customer relationship management platform developed by 5kCRM (CPE: cpe:2.3:a:5kcrm:wukong_crm:9.0:*:*:*:*:*:*:*). The root cause is CWE-502 (Deserialization of Untrusted Data) in the Alibaba fastjson library, which is pervasive in Chinese Java ecosystems. Fastjson's AutoType feature resolves Java class names from a JSON @type field at parse time; when not restricted by a denylist or allowlist, attacker-supplied @type values can instantiate arbitrary classes whose constructors or property setters act as gadget-chain entry points. The vulnerable endpoint /OaExamine/setOaExamine belongs to WukongCRM's OA examination workflow module and appears to deserialize user-supplied JSON without adequate type validation, allowing exploitation of whichever dangerous gadget classes (e.g., from commons-collections, spring-core, or similar) are present on the server's runtime classpath.

RemediationAI

No vendor-released patch has been identified at time of analysis - available references point exclusively to researcher POC writeups at https://gist.github.com/ChangeYourWay/424478421d6a78d1f87d324cddcbfd59 and https://github.com/ChangeYourWay/post/blob/main/WukongCRM-9.0-JAVA.md, not a vendor fix. As an immediate compensating control, restrict network access to the /OaExamine/setOaExamine endpoint via WAF rules or reverse-proxy ACLs - the trade-off is that the OA examination workflow will be unavailable to blocked network segments. If the underlying fastjson library version can be identified and upgraded, fastjson 1.2.83 or later with AutoType disabled (ParserConfig.getGlobalInstance().setAutoTypeSupport(false)) significantly reduces gadget-chain attack surface, though this may break deserialization of existing serialized data and requires regression testing. Organizations should monitor 5kCRM's official channels for a patched release given the public POC availability.