HGiga OAKlouds Deserialization and File Read

Unauthenticated remote code execution affects HGiga's OAKlouds Custom Page module in the 2.0, 3.0 and 4.0 lines at builds below 26, where an attacker who can reach the Custom Page endpoint can submit malicious serialized content and have it deserialized into arbitrary code running with the web service's privileges. The CVSS 4.0 score of 9.3 reflects the worst case for an unauthenticated network attacker (PR:N, UI:N, AT:N, high confidentiality, integrity and availability impact on the vulnerable system), and the practical limiter is exposure - whether the affected instance is reachable from untrusted networks - rather than any technical precondition. No public exploit code has been identified at time of analysis and the flaw is not currently listed as confirmed actively exploited (CISA KEV), but the low attack complexity, unauthenticated access and full-system impact make this a genuinely high-priority issue for any organization running the affected builds, and a vendor fix is available.

Unauthenticated relative path traversal in HGiga OAKlouds Bulletin V3 (2.0 and 3.0 product lines, module builds below 107) lets remote attackers read arbitrary files from the underlying host, potentially exposing configuration files, stored credentials, and other sensitive system data. Both the published CVSS 4.0 score of 8.7 and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) agree that no authentication, no user interaction, and no non-default configuration are required - the only prerequisites are network reachability of the Bulletin web interface and a vulnerable build. No public exploit identified at time of analysis, and the vendor has released a fix in build 107, so residual risk hinges on whether internet-facing or partner-exposed deployments have actually been upgraded. This is a genuinely high-priority issue given the unauthenticated, confidentiality-only but high-impact nature of the flaw and the often sensitive content of Taiwanese bulletin/portal deployments.