{"id":"CVE-2026-102455","published":"2026-09-30T09:17:13.343","lastModified":"2026-09-30T16:30:42.327","description":"EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://www.twcert.org.tw/en/cp-139-11242-13f37-2.html","tags":[]},{"url":"https://www.twcert.org.tw/tw/cp-132-11237-c9189-1.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"EasyFlow .NET developed by Digiwin has an Insecure Deserialization vulnerability, allowing unauthenticated attackers to execute arbitrary code on the server.","exploitability":"Exploitation is relatively straightforward as it requires sending maliciously crafted serialized content, which can be done without authentication.","blast_radius":"If exploited, this vulnerability could lead to complete server compromise, potentially affecting all users and services running on the server.","remediation":"Upgrade to the latest version of EasyFlow .NET developed by Digiwin.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","deserialization","web","arbitrary-code-execution"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-01T08:43:39.823Z"}}