Deer WMS 2 CVE-2025-8126

Upgrade Deer WMS 2 to version 3.4 or later once released by the vendor, verifying the fix through the official Gitee repository at https://gitee.com/deerwms/deer-wms-2. As an interim compensating control, restrict network access to the /system/user/export endpoint to trusted internal networks only using a reverse proxy or WAF rule that blocks requests with suspicious SQL keywords in the params[dataScope] parameter (e.g., UNION, SELECT, OR, --). Additionally, enforce strong authentication mechanisms including multi-factor authentication for administrative accounts and implement principle of least privilege so that user export functionality is restricted to only those roles that require it. Monitor access logs for repeated 401/403 errors or unusual parameter patterns on the /system/user/export endpoint. Note that WAF rules may block legitimate exports containing certain characters, requiring testing before production deployment. These compensating controls should be considered temporary-vendor patching remains the definitive fix.