Forwarded TWCERT/CC (Taiwan Computer Emergency Response Team and Coordination Center) Security Alert TWCERTCC-200-202610-00000007
The Digiwin product EasyFlow .NET has 5 security vulnerabilities, of which 2 are critical security vulnerabilities:
【Digiwin | EasyFlow .NET - Insecure Deserialization】(CVE-2026-102455, CVSS: 9.8) An unauthenticated remote attacker can execute arbitrary code on the server by sending malicious serialized content.
【Digiwin | EasyFlow .NET - SQL Injection】(CVE-2026-102456, CVSS: 6.5) An authenticated remote attacker can inject arbitrary SQL commands to read database contents.
【Digiwin | EasyFlow .NET - Arbitrary File Read】(CVE-2026-102457, CVSS: 6.5) An authenticated remote attacker can exploit this vulnerability to download arbitrary system files.
【Digiwin | EasyFlow .NET - Missing Authentication】(CVE-2026-102458, CVSS: 9.8) An unauthenticated remote attacker can obtain other users' plaintext passwords through a specific
API.
【Digiwin | EasyFlow .NET - Missing Authentication】(CVE-2026-102459, CVSS: 6.1) An unauthenticated remote attacker can execute arbitrary JavaScript code in the user's browser by means of a phishing attack.