Tongda — Vulnerabilities & Security Advisories 53

Tongda is a prominent provider of office automation and enterprise collaboration software, primarily serving large organizations in China with integrated platforms for workflow management, document control, and communication. Historically, its products have been plagued by a significant volume of security flaws, currently totaling 53 recorded CVEs. These vulnerabilities predominantly involve remote code execution, cross-site scripting, and authentication bypasses, often stemming from insecure deserialization and weak input validation in legacy modules. Notable incidents include widespread exploitation of unauthenticated remote code execution flaws that allowed attackers to gain full system control, leading to massive data breaches and ransomware deployments across numerous enterprises. The high frequency of critical severity ratings underscores persistent issues in code quality and patch management, making the software a frequent target for automated scanning tools and state-sponsored threat actors seeking initial access points within corporate networks.