CVE-2026-113404

Publié : 20 octobre 2026

Modifié : 20 octobre 2026

Score CVSS

8.8

HIGH

Description détaillée

WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Références et Patchs

https://www.twcert.org.tw/en/cp-139-11297-7c6f6-2.html https://www.twcert.org.tw/tw/cp-132-11296-d3d95-1.html

Dernières Vulnérabilités

CVE-2026-43835

A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device permanently.

VOIR DÉTAILS

CVE-2026-43834

A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code execution.

VOIR DÉTAILS

CVE-2026-113407

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.

VOIR DÉTAILS