On October 20, TWCERT/CC published TVN-202610005: Kaifa Technology's WebITR contains an insecure deserialization vulnerability (CVSS v4.0 8.7) that allows authenticated remote attackers to use a hardcoded encryption key to send malicious serialized data and execute arbitrary code on the server [1]. Versions 2_1_0_34 and earlier are affected; update to version 2_1_0_36 or later [1].
Kaifa Technology WebITR Time and Attendance System Insecure Deserialization Vulnerability Allows Arbitrary Code Execution (CVE-2026-113404)
1 min read
- Disclosed
- Oct 20, 2026
- Published
- Nov 7, 2026
- Last updated
- Nov 6, 2026
- CVSS basis
- [1]
- 0.4%, higher than 39% of CVEs
- Exploitation and patch status
- Patch available
- Technology
- Vulnerability status
On this page
30-second summary
Affected scope
| Affected scope | Versions | Fixed in | |
|---|---|---|---|
| 凱發科技 WebITR | <= 2_1_0_34[1] | 2_1_0_36 | ✓ Patched |
Do you run this product?
Add it to your systems list and we'll email you about related advisories and major updates.
Timeline
- TWCERT/CC publishes TVN vulnerability advisory; patched version released[1]
Technical details
Vulnerability Details
WebITR is a time and attendance system widely used across government agencies and enterprises in Taiwan. Due to a hardcoded encryption key combined with insecure deserialization, CVE-2026-113404 allows a regular authenticated user to achieve [1]. The vulnerability was reported by DEVCORE [1].
Remediation
Vendor guidance
- 1Update to 2_1_0_36 patch[1]
References
Official / primary1
- [1]
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.