Uniong WebITR EUVD-2026-104808

Exploitation requires (1) an authenticated session - the CVSS vector specifies PR:L, so a valid low-privilege WebITR account is needed - and (2) the application's use of a hard-coded cryptographic key to protect serialized data, which lets the attacker forge payloads that pass integrity validation and reach the vulnerable deserialization routine. The key limiting factor is the authentication requirement (not remotely unauthenticated); however, because the cryptographic key is static and embedded in the product rather than per-deployment, the protection it is meant to provide is effectively nullified, so the authentication barrier is the primary remaining control. No user interaction is required (UI:N) and no non-default configuration is indicated in the description.

This is a genuine high-priority vulnerability for organizations running WebITR, though real-world exposure is bounded by the product's niche footprint. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring only low-level authentication, with high impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H) of the affected server - consistent with the CWE-502 insecure deserialization leading to RCE. The aggravating factor is the hard-coded cryptographic key: because the key used to sign or encrypt serialized data is static and shared across deployments, any authenticated user (and potentially anyone who extracts the key from the software) can forge valid malicious payloads, effectively lowering the practical barrier that PR:L would otherwise imply. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the elevated score reflects technical impact and ease of exploitation, not confirmed in-the-wild activity. The main reason this is not a top-tier emergency across the broader internet is prevalence: WebITR is a regional (Taiwan) HR/attendance product, so the absolute population of exposed instances is small even though each instance is seriously at risk.

An attacker with any valid low-privilege WebITR account (or who has obtained a session through weak credentials) uses the publicly shared hard-coded cryptographic key to craft a malicious serialized object that passes integrity/signature checks. They submit this payload to a WebITR endpoint that deserializes it, triggering arbitrary code execution on the server with the privileges of the web application. No public proof-of-concept was provided in the input, and the CVSS low attack complexity (AC:L) indicates the attack is reliable once the account and key are in hand.