Posting Date: 2026/10/13
【Vulnerability Alert】Digiwin | EasyFlow .NET - 2 Critical Security Vulnerabilities Exist
- Subject:【Vulnerability Alert】Digiwin | EasyFlow .NET - 2 Critical Security Vulnerabilities Exist
- Description:
- Forwarded TWCERT/CC (Taiwan Computer Emergency Response Team and Coordination Center) Security Alert TWCERTCC-200-202610-00000007
- The Digiwin product EasyFlow .NET has 5 security vulnerabilities, of which 2 are critical security vulnerabilities:
- 【Digiwin | EasyFlow .NET - Insecure Deserialization】(CVE-2026-102455, CVSS: 9.8) An unauthenticated remote attacker can execute arbitrary code on the server by sending malicious serialized content.
- 【Digiwin | EasyFlow .NET - SQL Injection】(CVE-2026-102456, CVSS: 6.5) An authenticated remote attacker can inject arbitrary SQL commands to read database contents.
- 【Digiwin | EasyFlow .NET - Arbitrary File Read】(CVE-2026-102457, CVSS: 6.5) An authenticated remote attacker can exploit this vulnerability to download arbitrary system files.
- 【Digiwin | EasyFlow .NET - Missing Authentication】(CVE-2026-102458, CVSS: 9.8) An unauthenticated remote attacker can obtain other users' plaintext passwords through a specific API.
- 【Digiwin | EasyFlow .NET - Missing Authentication】(CVE-2026-102459, CVSS: 6.1) An unauthenticated remote attacker can execute arbitrary JavaScript code in the user's browser by means of a phishing attack.
- Affected Platforms:
- EasyFlow .NET versions up to and including V6.1.x, EasyFlow .NET versions up to and including V6.6.19, EasyFlow .NET versions up to and including V8.1.5
- Recommended Actions:
- 【CVE-2026-102455】 Update the patch to a version released after 2026/04/16
- 【CVE-2026-102456, CVE-2026-102459】 Update the patch to a version released after 2026/06/26
- 【CVE-2026-102457】 Update the patch to a version released after 2026/04/20
- 【CVE-2026-102458】 Update the patch to a version released after 2026/04/17
- References:
Computer and Communication Center
Network System Division
