Uniong WebITR: Insecure deserialization with hard-coded cryptographic key
Summary
Uniong WebITR versions 2_1_0_34 and earlier contain an insecure deserialization flaw (CWE-502). An authenticated remote attacker can use a hard-coded cryptographic key to craft and submit malicious serialized data, which executes arbitrary code on the server. The attacker needs a valid login, but any weakness that exposes or bypasses the login would make this easier to exploit. The CNA rates the CVSS 4.0 base score at 8.7 (High); NVD analysis was still pending.
Affected
- WebITR 2_1_0_34 and earlier (range 0 to 2_1_0_34 per the CNA record)
Fixed in
- Update to WebITR 2_1_0_36 or later (per the CNA record and TWCERT/CC)
- Whether 2_1_0_35 is fixed is not stated in the sources.
- Vendor confirmation of the fixed version was not found.
Workaround
- No workaround is documented in the sources.
- Updating to 2_1_0_36 or later is the remedy.
Exploitation
- No known exploitation according to the sources; the CVE is not in CISA KEV.
- No public proof of concept found; VulDB states no exploit is available.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- EPSS score 0.35%.
Our recommendation
- Identify all WebITR installations and their versions in customer environments.
- Update all instances below 2_1_0_36 to 2_1_0_36 or later; prioritise internet-exposed instances.
- Restrict access to the WebITR administration interface to management networks or VPN.
- Review existing user accounts and remove unneeded ones.
- On exposed hosts, check logs for signs of prior compromise.
- Confirm the fixed version with the vendor, as the vendor advisory was not located.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- TWCERT/CC TVN-202610005 (English) www.twcert.org.tw
- TWCERT/CC TVN-202610005 (Chinese) www.twcert.org.tw
- OpenCVE CVE-2026-113404 app.opencve.io
- VulDB CVE-2026-113404 vuldb.com
- VulDB 422680 (exploit status) vuldb.com
- HOL CVE-2026-113404 hol.org
- Strix CVE-2026-113404 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:35.
Original description (NVD)
WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.