CVE-2023-48392: Kaifa Technology WebITR - Hard-coded Cryptographic Key

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-15 · updated 2026-06-17
Weakness: CWE-321

Description

Kaifa Technology WebITR is an online attendance system, it has a vulnerability in using hard-coded encryption key. An unauthenticated remote attacker can generate valid token parameter and exploit this vulnerability to access system with arbitrary user account, including administrator’s account, to execute login account’s permissions, and obtain relevant information.

Affected products

Kaifa Technology WebITR: 2.1.0.23

References

https://www.twcert.org.tw/tw/cp-132-7622-57e5f-1.html
https://www.twcert.org.tw/tw/cp-132-7622-57e5f-1.html

Get alerted when CVE-2023-48392 or the next vulnerability affects your stack