CVE-2026-113404: Uniong｜WebITR - Insecure Deserialization
WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Uniong WebITRto a version that resolves this vulnerability.Fixed in 2_1_0_36
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authenticated and able to reach the WebITR service remotely. The attack does not require user interaction.
What does an attacker need to carry out the attack?
The attacker needs the hard-coded cryptographic key and the ability to submit crafted serialized data to the affected WebITR application.
What is the potential impact of successful exploitation?
Successful exploitation can allow arbitrary code execution on the server, with high impacts to confidentiality, integrity, and availability.