Posting Date: 2026/10/15

【Vulnerability Alert】互動資通｜TeamPlus Messenger - 2 vulnerabilities exist

  • Subject:【Vulnerability Alert】互動資通｜TeamPlus Messenger - 2 vulnerabilities exist


  • Description:
    • Forwarded from the TWCERT/CC Security Alert TWCERTCC-200-202610-00000024
    • The 互動資通 product TeamPlus Messenger has 2 security vulnerabilities:
    • 【互動資通｜TeamPlus Messenger - Code Injection】(CVE-2026-110444, CVSS: 8.8) An unauthenticated remote attacker can lure a user into opening a specially crafted link, inject and execute arbitrary JavaScript, and then execute arbitrary code with the current user's privileges after the user confirms the security warning.
    • 【互動資通｜TeamPlus Messenger - Code Injection】(CVE-2026-110445, CVSS: 8.8) An unauthenticated remote attacker can lure a user into interacting with specially crafted content, inject and execute arbitrary JavaScript, and then execute arbitrary code with the current user's privileges after the user confirms the security warning.
  • Affected Platforms:
    • TeamPlus Messenger versions from v16.8.0 to v17.0.6
  • Recommended Actions:
    • Update to TeamPlus Messenger v17.0.7 (inclusive) or later
  • References:
    1. https://www.twcert.org.tw/tw/cp-132-11270-88d86-1.html

Computer and Communication Center
Network System Division