This vulnerability affects the Hessian2Input.readObject method in the /serialize/impl/HessianSerializer.java file of the xxl-rpc Listener component in alldatacenter alldata up to version 0.6.8. The flaw allows remote attackers to manipulate deserialization processes, potentially leading to security issues. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. Exploit code is publicly available, but the vendor has not planned any remediation.

The vulnerability enables remote attackers to exploit deserialization in the affected versions, which could lead to unauthorized actions or compromise depending on the deserialization context. The CVSS score indicates a medium severity impact with low impact on confidentiality, integrity, and availability. There is no evidence of active exploitation in the wild.

No official fix or patch is available as the vendor has closed the issue report as "not planned" without further explanation. Users should consider alternative mitigations such as disabling or restricting the vulnerable component if possible, or applying network-level protections to limit exposure. Monitor vendor channels for any future updates.