{"id":"CVE-2026-113404","kind":"vulnerability","aliases":["CVE-2026-113404"],"related":[],"title":"WebITR: insecure deserialization lets authenticated users run code on server","description":"WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server.","summary":"Uniong WebITR deserializes untrusted data and the key is hard-coded. A logged-in attacker can craft serialized data and run code on the server. Affects 2_1_0_34 and earlier. Fixed in 2_1_0_36. Reported by Xin Yu Lin (DEVCORE).","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WebITR","fixed":["2_1_0_36"],"affected":"<= 2_1_0_34","ecosystem":"vendor"}],"ecosystems":[],"tags":["deserialization","other","rce","self-hosted","uniong","webitr"],"not_affected_if":["auth-required"],"how_to_check":"Check the installed WebITR version in the admin UI or install directory. Versions 2_1_0_34 and earlier are vulnerable. The vendor page does not give a more specific check.","fix":"Update WebITR to 2_1_0_36 or later. Until you can, limit network access to WebITR to trusted users only.","status":"open","published_at":"2026-10-20T07:17:09+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:32:53+00:00","updated_at":"2026-10-24T00:18:00+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:32:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"WebITR: insecure deserialization lets authenticated users run code on server","impact":"high","summary":"WebITR, a product from Uniong, deserializes untrusted data using a hard-coded cryptographic key. An authenticated remote attacker can submit crafted serialized data and execute arbitrary code on the server.","category":"other","who_cares":["webitr","uniong","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs arbitrary code on the server after logging in","analyst_note":"Find the vendor advisory or patched WebITR version from Uniong and the affected version range; the NVD entry alone gives no fix or check.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000448,"input_tokens":2881,"output_tokens":320,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory or patched WebITR version from Uniong and the affected version range; the NVD entry alone gives no fix or check.","search":"'-113404':13A,16A '-2026':12A,15A '0':56B,64B '1':55B,63B '2':54B,62B '34':57B '36':65B 'affect':53B 'arbitrari':101C 'attack':42B,83C 'authent':5A,81C 'code':8A,37B,49B,89C,102C 'craft':44B,93C 'cryptograph':90C 'cve':11A,14A 'data':30B,46B,98C 'deseri':3A,18B,28B,79C 'devcor':71B 'develop':73C 'earlier':59B 'execut':100C 'fix':60B 'hard':36B,88C 'hard-cod':35B,87C 'host':23B 'insecur':2A,78C 'key':33B,91C 'let':4A 'lin':70B 'log':40B 'logged-in':39B 'malici':96C 'rce':20B 'remot':82C 'report':66B 'run':7A,48B 'self':22B 'self-host':21B 'serial':45B,97C 'server':10A,52B,105C 'submit':95C 'therebi':99C 'uniong':24B,26B,75C 'untrust':29B 'use':85C 'user':6A 'vulner':80C 'webitr':1A,17A,25B,27B,72C 'xin':68B 'yu':69B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T07:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"twcert@cert.org.tw","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113404","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113404","severity":null,"published_at":"2026-10-20T07:17:09+00:00","modified_at":"2026-10-20T19:28:52+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113404:630","url":null,"severity":null,"published_at":"2026-10-24T00:18:00+00:00","modified_at":"2026-10-24T00:18:00+00:00","first_seen_at":"2026-10-24T00:18:00+00:00","fetched_at":"2026-10-24T00:18:00+00:00","note":"TWCERT/CC TVN-202610005 (primary coordinator page): WebITR 2_1_0_34 and earlier affected, fixed in 2_1_0_36. No exploitation or PoC found; no social search done (niche Taiwanese product). Ignored VulDB's description (calls WebITR an intrusion detection system, which looks wrong). Uniong's own page not found."}],"documents":[{"id":2534,"url":"https://www.twcert.org.tw/en/cp-139-11297-7c6f6-2.html","title":"TWCERT/CC TVN-202610005: Uniong WebITR - Insecure Deserialization","kind":"advisory","source":"analyst","text":"Affected: WebITR version 2_1_0_34 and earlier. Solution: update to 2_1_0_36 or later. CVSS 4.0 8.7 / 3.1 8.8. Credit Xin Yu Lin (DEVCORE). Public 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2536,"url":"https://github.com/advisories/GHSA-jppw-qwg2-2hgc","title":"GitHub Advisory GHSA-jppw-qwg2-2hgc (CVE-2026-113404)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}