Search
Find a vulnerability
Search criteria
14 vulnerabilities by WolfVision
CVE-2026-70382 (GCVE-0-2026-70382)
Vulnerability from nvd – Published: 2026-10-26 19:59 – Updated: 2026-10-26 19:59
VLAI
EPSS
VEX
Title
Stored Cross-Site Scripting in Web Interface
Summary
Some externally supplied values stored by the device may be rendered in the web interface without sufficient output encoding. An attacker who can influence one of these values could cause script execution in the browser of a user who views an affected page. Exploitation requires an attacker to influence a stored value and a user to view a page that renders it.
Severity
4.1 (Medium)
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wolfvision.com/de/security/cve-2026-70382-1 | vendor-advisory |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| WolfVision | Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro |
Affected:
0 , < 1.78a
(custom)
|
|
| WolfVision | Cynap Pure (Next Gen), Cynap Bridge |
Affected:
0 , < 2.00d
(custom)
|
|
| WolfVision | Cynap Videobar |
Affected:
0 , < 1.72e
(custom)
|
|
| WolfVision | Cynap, Cynap Core, Cynap Pure SDM |
Affected:
0
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro",
"vendor": "WolfVision",
"versions": [
{
"lessThan": "1.78a",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cynap Pure (Next Gen), Cynap Bridge",
"vendor": "WolfVision",
"versions": [
{
"lessThan": "2.00d",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cynap Videobar",
"vendor": "WolfVision",
"versions": [
{
"lessThan": "1.72e",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "Cynap, Cynap Core, Cynap Pure SDM",
"vendor": "WolfVision",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "National Test Institute for Cybersecurity (NTC)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Some externally supplied values stored by the device may be rendered in the web interface without sufficient output encoding. An attacker who can influence one of these values could cause script execution in the browser of a user who views an affected page. Exploitation requires an attacker to influence a stored value and a user to view a page that renders it."
}
],
"value": "Some externally supplied values stored by the device may be rendered in the web interface without sufficient output encoding. An attacker who can influence one of these values could cause script execution in the browser of a user who views an affected page. Exploitation requires an attacker to influence a stored value and a user to view a page that renders it."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T19:59:46.065Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://wolfvision.com/de/security/cve-2026-70382-1"
}
],
"title": "Stored Cross-Site Scripting in Web Interface",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Until an update can be applied, consider the following measures where operationally feasible:\u003cbr\u003e\u003cul\u003e\u003cli\u003eRestrict access to the web management interfaces on TCP ports 80 and 443 to trusted hosts only.\u003c/li\u003e\u003c/ul\u003e\u003cul\u003e\u003cli\u003eAvoid opening or displaying content from untrusted sources on the device until it is updated.\u003c/li\u003e\u003c/ul\u003e\u003ci\u003eWolfVision recommends keeping devices up to date and using dedicated, managed network segments (VLAN or firewall zone) to restrict device access to trusted hosts only.\u003c/i\u003e\u003cbr\u003e"
}
],
"value": "Until an update can be applied, consider the following measures where operationally feasible:\n * Restrict access to the web management interfaces on TCP ports 80 and 443 to trusted hosts only.\n\n\n * Avoid opening or displaying content from untrusted sources on the device until it is updated.\n\n\nWolfVision recommends keeping devices up to date and using dedicated, managed network segments (VLAN or firewall zone) to restrict device access to trusted hosts only."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-70382",
"datePublished": "2026-10-26T19:59:46.065Z",
"dateReserved": "2026-08-04T07:41:00.082Z",
"dateUpdated": "2026-10-26T19:59:46.065Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70381 (GCVE-0-2026-70381)
Vulnerability from nvd – Published: 2026-10-26 19:52 – Updated: 2026-10-26 19:52
VLAI
EPSS
VEX
Title
Unauthorized Access to Internal Web Resources
Summary
An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be accessed remotely by an unauthenticated attacker with network access to the web interface.
The accessible resources do not expose credentials or provide administrative functionality, but may include non-public device content, such as screen-saver content or assets used by the web interface.
Severity
5.3 (Medium)
CWE
- CWE-290 - Authentication bypass by spoofing
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wolfvision.com/de/security/cve-2026-70381-1 | vendor-advisory |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| WolfVision | Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro |
Affected:
0 , < 1.78a
(custom)
|
|
| WolfVision | Cynap Pure (Next Gen), Cynap Bridge |
Affected:
0 , < 2.00d
(custom)
|
|
| WolfVision | Cynap Videobar |
Affected:
0 , < 1.72e
(custom)
|
|
| WolfVision | Cynap, Cynap Core, Cynap Pure SDM |
Affected:
0
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro",
"vendor": "WolfVision",
"versions": [
{
"lessThan": "1.78a",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cynap Pure (Next Gen), Cynap Bridge",
"vendor": "WolfVision",
"versions": [
{
"lessThan": "2.00d",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cynap Videobar",
"vendor": "WolfVision",
"versions": [
{
"lessThan": "1.72e",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "Cynap, Cynap Core, Cynap Pure SDM",
"vendor": "WolfVision",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "National Test Institute for Cybersecurity (NTC)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be accessed remotely by an unauthenticated attacker with network access to the web interface.\u003cbr\u003eThe accessible resources do not expose credentials or provide administrative functionality, but may include non-public device content, such as screen-saver content or assets used by the web interface.\u003cbr\u003e"
}
],
"value": "An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be accessed remotely by an unauthenticated attacker with network access to the web interface.\nThe accessible resources do not expose credentials or provide administrative functionality, but may include non-public device content, such as screen-saver content or assets used by the web interface."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication bypass by spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T19:52:44.232Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://wolfvision.com/de/security/cve-2026-70381-1"
}
],
"title": "Unauthorized Access to Internal Web Resources",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Until an update can be applied, consider the following measures where operationally feasible:\u003cbr\u003e\u003cul\u003e\u003cli\u003eRestrict network access to the web management interfaces on TCP ports 80 and 443 to trusted hosts only.\u003c/li\u003e\u003c/ul\u003e\u003ci\u003eWolfVision recommends keeping devices up to date and using dedicated, managed network segments (VLAN or firewall zone) to restrict device access to trusted hosts only.\u003c/i\u003e\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "Until an update can be applied, consider the following measures where operationally feasible:\n * Restrict network access to the web management interfaces on TCP ports 80 and 443 to trusted hosts only.\n\n\nWolfVision recommends keeping devices up to date and using dedicated, managed network segments (VLAN or firewall zone) to restrict device access to trusted hosts only."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-70381",
"datePublished": "2026-10-26T19:52:44.232Z",
"dateReserved": "2026-08-04T07:41:00.082Z",
"dateUpdated": "2026-10-26T19:52:44.232Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70380 (GCVE-0-2026-70380)
Vulnerability from nvd – Published: 2026-10-26 19:45 – Updated: 2026-10-26 19:45
VLAI
EPSS
VEX
Title
Resource Exhaustion in MICE Service
Summary
A denial-of-service vulnerability has been identified in the Miracast over Infrastructure Connection Establishment (MICE) service. An unauthenticated attacker with network access to the MICE service could consume available connection capacity, preventing legitimate users from establishing MICE-based Miracast connections while the condition persists.
Miracast P2P is not affected. MICE is disabled in the default configuration and must be explicitly enabled by the customer. On most devices, Miracast P2P is available independently of MICE, but a complete disruption of Miracast can occur on some devices when WLAN is configured for Infrastructure mode.
Severity
5.3 (Medium)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wolfvision.com/de/security/cve-2026-70380-1 | vendor-advisory |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| WolfVision | Cynap Pro, Cynap Core Pro, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro |
Affected:
0 , < 1.78a
(custom)
|
|
| WolfVision | Cynap Pure (Next Gen) |
Affected:
0 , < 2.00d
(custom)
|
|
| WolfVision | Cynap Videobar |
Affected:
0 , < 1.72e
(custom)
|
|
| WolfVision | Cynap, Cynap Core, Cynap Pure SDM |
Affected:
0
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cynap Pro, Cynap Core Pro, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro",
"vendor": "WolfVision",
"versions": [
{
"lessThan": "1.78a",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cynap Pure (Next Gen)",
"vendor": "WolfVision",
"versions": [
{
"lessThan": "2.00d",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cynap Videobar",
"vendor": "WolfVision",
"versions": [
{
"lessThan": "1.72e",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "Cynap, Cynap Core, Cynap Pure SDM",
"vendor": "WolfVision",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "National Test Institute for Cybersecurity (NTC)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A denial-of-service vulnerability has been identified in the Miracast over Infrastructure Connection Establishment (MICE) service. An unauthenticated attacker with network access to the MICE service could consume available connection capacity, preventing legitimate users from establishing MICE-based Miracast connections while the condition persists.\u003cbr\u003eMiracast P2P is not affected. MICE is disabled in the default configuration and must be explicitly enabled by the customer. On most devices, Miracast P2P is available independently of MICE, but a complete disruption of Miracast can occur on some devices when WLAN is configured for Infrastructure mode.\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "A denial-of-service vulnerability has been identified in the Miracast over Infrastructure Connection Establishment (MICE) service. An unauthenticated attacker with network access to the MICE service could consume available connection capacity, preventing legitimate users from establishing MICE-based Miracast connections while the condition persists.\nMiracast P2P is not affected. MICE is disabled in the default configuration and must be explicitly enabled by the customer. On most devices, Miracast P2P is available independently of MICE, but a complete disruption of Miracast can occur on some devices when WLAN is configured for Infrastructure mode."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T19:45:17.820Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://wolfvision.com/de/security/cve-2026-70380-1"
}
],
"title": "Resource Exhaustion in MICE Service",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Until an update can be applied, consider the following measures where operationally feasible:\u003cbr\u003e\u003cul\u003e\u003cli\u003eRestrict access to the MICE service on TCP port 7250 to trusted hosts only.\u003c/li\u003e\u003c/ul\u003eWolfVision recommends keeping devices up to date and using dedicated, managed network segments (VLAN or firewall zone) to restrict device access to trusted hosts only.\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "Until an update can be applied, consider the following measures where operationally feasible:\n * Restrict access to the MICE service on TCP port 7250 to trusted hosts only.\n\n\nWolfVision recommends keeping devices up to date and using dedicated, managed network segments (VLAN or firewall zone) to restrict device access to trusted hosts only."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-70380",
"datePublished": "2026-10-26T19:45:17.820Z",
"dateReserved": "2026-08-04T07:41:00.082Z",
"dateUpdated": "2026-10-26T19:45:17.820Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70379 (GCVE-0-2026-70379)
Vulnerability from nvd – Published: 2026-10-26 17:48 – Updated: 2026-10-26 17:48
VLAI
EPSS
VEX
Title
Unauthorized Access to vSolution Matrix RTSP
Summary
When the vSolution Matrix feature is enabled, affected devices may make current screen content available through an unauthenticated RTSP/RTP stream to hosts on the same network segment. The stream is not encrypted, which may allow an unauthenticated host to view or capture presentation content where network access is not otherwise restricted. This vulnerability only affects devices with the vSolution Matrix feature enabled.
Severity
CWE
- CWE-319 - Cleartext transmission of sensitive information
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wolfvision.com/de/security/cve-2026-70379-1 | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WolfVision | Cynap Pro, Cynap Core Pro |
Affected:
0 , < 1.78a
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cynap Pro, Cynap Core Pro",
"vendor": "WolfVision",
"versions": [
{
"lessThan": "1.78a",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "National Test Institute for Cybersecurity (NTC)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When the vSolution Matrix feature is enabled, affected devices may make current screen content available through an unauthenticated RTSP/RTP stream to hosts on the same network segment. The stream is not encrypted, which may allow an unauthenticated host to view or capture presentation content where network access is not otherwise restricted. This vulnerability only affects devices with the vSolution Matrix feature enabled.\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "When the vSolution Matrix feature is enabled, affected devices may make current screen content available through an unauthenticated RTSP/RTP stream to hosts on the same network segment. The stream is not encrypted, which may allow an unauthenticated host to view or capture presentation content where network access is not otherwise restricted. This vulnerability only affects devices with the vSolution Matrix feature enabled."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-319",
"description": "CWE-319 Cleartext transmission of sensitive information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T17:48:55.829Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://wolfvision.com/de/security/cve-2026-70379-1"
}
],
"title": "Unauthorized Access to vSolution Matrix RTSP",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Until an update can be applied, consider the following measures where operationally feasible:\u003cbr\u003e\u003cul\u003e\u003cli\u003eDisable the \"vSolution Matrix\" feature if it is not required.\u003c/li\u003e\u003cli\u003eRestrict vSolution Matrix to networks that contain only trusted Matrix stations.\u003c/li\u003e\u003c/ul\u003eIf network separation is not feasible, block the following on a firewall:\u003cul\u003e\u003cli\u003eInbound RTSP control: TCP 554 and 8554. The device redirects TCP 554 to 8554, and Matrix clients connect to 8554.\u003c/li\u003e\u003cli\u003eOutbound audio and video multicast from the device: UDP 5500-5503 by default.\u003c/li\u003e\u003cli\u003eOn Cynap Core and on Cynap Pro, also block inbound TCP 555 and 8555 and outbound UDP 5504-5507. These ports carry the second HDMI stream.\u003c/li\u003e\u003cli\u003eIf the multicast port base is not 5500 (see device settings), replace 5500-5503 with that base through base+3, and 5504-5507 with base+4 through base+7.\u003c/li\u003e\u003c/ul\u003eWolfVision recommends keeping devices up to date and using dedicated, managed network segments (VLAN or firewall zone) to restrict device access to trusted hosts only.\u003cbr\u003e"
}
],
"value": "Until an update can be applied, consider the following measures where operationally feasible:\n * Disable the \"vSolution Matrix\" feature if it is not required.\n * Restrict vSolution Matrix to networks that contain only trusted Matrix stations.\n\n\nIf network separation is not feasible, block the following on a firewall: * Inbound RTSP control: TCP 554 and 8554. The device redirects TCP 554 to 8554, and Matrix clients connect to 8554.\n * Outbound audio and video multicast from the device: UDP 5500-5503 by default.\n * On Cynap Core and on Cynap Pro, also block inbound TCP 555 and 8555 and outbound UDP 5504-5507. These ports carry the second HDMI stream.\n * If the multicast port base is not 5500 (see device settings), replace 5500-5503 with that base through base+3, and 5504-5507 with base+4 through base+7.\n\n\nWolfVision recommends keeping devices up to date and using dedicated, managed network segments (VLAN or firewall zone) to restrict device access to trusted hosts only."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-70379",
"datePublished": "2026-10-26T17:48:55.829Z",
"dateReserved": "2026-08-04T07:41:00.082Z",
"dateUpdated": "2026-10-26T17:48:55.829Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59107 (GCVE-0-2026-59107)
Vulnerability from nvd – Published: 2026-10-26 13:33 – Updated: 2026-10-26 13:33
VLAI
EPSS
VEX
Title
Shared SSH Authentication Key in vSolution Matrix File Sharing
Summary
A security vulnerability has been identified in the vSolution Matrix file sharing feature. A shared cryptographic trust configuration could allow an attacker who obtains the matching private key to authenticate to an affected device via SSH as root. This vulnerability affects only devices configured as a vSolution Matrix main/master station with the file sharing feature enabled.
Severity
9.8 (Critical)
CWE
- CWE-797 - Use of Hard-coded Credentials
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wolfvision.com/de/security/cve-2026-59107-1 | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| WolfVision | Cynap Pro, Cynap Core Pro |
Affected:
0 , < 1.78a
(custom)
|
|
| WolfVision | Cynap, Cynap Core |
Affected:
0
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cynap Pro, Cynap Core Pro",
"vendor": "WolfVision",
"versions": [
{
"lessThan": "1.78a",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "Cynap, Cynap Core",
"vendor": "WolfVision",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "National Test Institute for Cybersecurity (NTC)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A security vulnerability has been identified in the vSolution Matrix file sharing feature. A shared cryptographic trust configuration could allow an attacker who obtains the matching private key to authenticate to an affected device via SSH as root. This vulnerability affects only devices configured as a vSolution Matrix main/master station with the file sharing feature enabled."
}
],
"value": "A security vulnerability has been identified in the vSolution Matrix file sharing feature. A shared cryptographic trust configuration could allow an attacker who obtains the matching private key to authenticate to an affected device via SSH as root. This vulnerability affects only devices configured as a vSolution Matrix main/master station with the file sharing feature enabled."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-797",
"description": "CWE-797 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T13:33:12.851Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://wolfvision.com/de/security/cve-2026-59107-1"
}
],
"title": "Shared SSH Authentication Key in vSolution Matrix File Sharing",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Until an update can be applied, take the following measures where operationally feasible:\u003cbr\u003e\u003cul\u003e\u003cli\u003eDisable vSolution Matrix file sharing if the feature is not required.\u003c/li\u003e\u003cli\u003eRestrict access to the vSolution Matrix file sharing service on TCP port 50930 to trusted hosts only.\u003c/li\u003e\u003c/ul\u003eWolfVision recommends keeping devices up to date and using dedicated, managed network segments (VLAN or firewall zone) to restrict device access to trusted hosts only."
}
],
"value": "Until an update can be applied, take the following measures where operationally feasible:\n * Disable vSolution Matrix file sharing if the feature is not required.\n * Restrict access to the vSolution Matrix file sharing service on TCP port 50930 to trusted hosts only.\n\n\nWolfVision recommends keeping devices up to date and using dedicated, managed network segments (VLAN or firewall zone) to restrict device access to trusted hosts only."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-59107",
"datePublished": "2026-10-26T13:33:12.851Z",
"dateReserved": "2026-07-02T15:47:36.964Z",
"dateUpdated": "2026-10-26T13:33:12.851Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59106 (GCVE-0-2026-59106)
Vulnerability from nvd – Published: 2026-10-26 13:15 – Updated: 2026-10-26 15:35
VLAI
EPSS
VEX
Title
Unauthenticated RCE Vulnerability in WolfProt interface implementation
Summary
A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker with network access to a vulnerable service to execute operating-system commands with the privileges of the affected application service.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 15:04 UTC
CWE
- CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wolfvision.com/de/security/cve-2026-59106-2 | vendor-advisory |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| WolfVision | Cynap Pure (Next Gen), Cynap Bridge |
Affected:
0 , < 2.00c
(custom)
|
|
| WolfVision | Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro |
Affected:
0 , < 1.78a
(custom)
|
|
| WolfVision | Cynap Videobar, Firmware Version |
Affected:
0 , < 1.72e
(custom)
|
|
| WolfVision | Cynap, Cynap Core, Cynap Pure SDM |
Affected:
0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59106",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T15:04:38.018668Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T15:35:52.374Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cynap Pure (Next Gen), Cynap Bridge",
"vendor": "WolfVision",
"versions": [
{
"lessThan": "2.00c",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro",
"vendor": "WolfVision",
"versions": [
{
"lessThan": "1.78a",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cynap Videobar, Firmware Version",
"vendor": "WolfVision",
"versions": [
{
"lessThan": "1.72e",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "Cynap, Cynap Core, Cynap Pure SDM",
"vendor": "WolfVision",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "National Test Institute for Cybersecurity (NTC)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker with network access to a vulnerable service to execute operating-system commands with the privileges of the affected application service."
}
],
"value": "A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker with network access to a vulnerable service to execute operating-system commands with the privileges of the affected application service."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T13:15:02.436Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://wolfvision.com/de/security/cve-2026-59106-2"
}
],
"title": "Unauthenticated RCE Vulnerability in WolfProt interface implementation",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUntil an update can be applied, restrict network access to the \nWolfProt-related ports (TCP 50915 and 50917) as well as the web \nmanagement interfaces (TCP 80 and 443) to trusted hosts only. Note that \nthese services cannot be disabled. WolfVision recommends keeping devices up to date and using \ndedicated, managed network segments (VLAN or firewall zone) to restrict \ndevice access to trusted hosts only.\u003c/p\u003e"
}
],
"value": "Until an update can be applied, restrict network access to the \nWolfProt-related ports (TCP 50915 and 50917) as well as the web \nmanagement interfaces (TCP 80 and 443) to trusted hosts only. Note that \nthese services cannot be disabled. WolfVision recommends keeping devices up to date and using \ndedicated, managed network segments (VLAN or firewall zone) to restrict \ndevice access to trusted hosts only."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-59106",
"datePublished": "2026-10-26T13:15:02.436Z",
"dateReserved": "2026-07-02T15:47:36.964Z",
"dateUpdated": "2026-10-26T15:35:52.374Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2019-13352 (GCVE-0-2019-13352)
Vulnerability from nvd – Published: 2019-07-05 19:33 – Updated: 2024-08-04 23:49
VLAI
EPSS
VEX
Summary
WolfVision Cynap before 1.30j uses a static, hard-coded cryptographic secret for generating support PINs for the 'forgot password' feature. By knowing this static secret and the corresponding algorithm for calculating support PINs, an attacker can reset the ADMIN password and thus gain remote access.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://packetstormsecurity.com/files/153530/WolfV… | x_refsource_MISC |
| https://www.syss.de/fileadmin/dokumente/Publikati… | x_refsource_MISC |
| http://seclists.org/fulldisclosure/2019/Jul/9 | mailing-listx_refsource_FULLDISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T23:49:24.830Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/153530/WolfVision-Cynap-1.18g-1.28j-Hardcoded-Credential.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-021.txt"
},
{
"name": "20190709 UPDATE: [SYSS-2019-021]: WolfVision Cynap - Use of Hard-coded Cryptographic Key (CWE-321) [CVE-2019-13352]",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2019/Jul/9"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "WolfVision Cynap before 1.30j uses a static, hard-coded cryptographic secret for generating support PINs for the \u0027forgot password\u0027 feature. By knowing this static secret and the corresponding algorithm for calculating support PINs, an attacker can reset the ADMIN password and thus gain remote access."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-07-10T17:06:05.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/153530/WolfVision-Cynap-1.18g-1.28j-Hardcoded-Credential.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-021.txt"
},
{
"name": "20190709 UPDATE: [SYSS-2019-021]: WolfVision Cynap - Use of Hard-coded Cryptographic Key (CWE-321) [CVE-2019-13352]",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2019/Jul/9"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-13352",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "WolfVision Cynap before 1.30j uses a static, hard-coded cryptographic secret for generating support PINs for the \u0027forgot password\u0027 feature. By knowing this static secret and the corresponding algorithm for calculating support PINs, an attacker can reset the ADMIN password and thus gain remote access."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://packetstormsecurity.com/files/153530/WolfVision-Cynap-1.18g-1.28j-Hardcoded-Credential.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/153530/WolfVision-Cynap-1.18g-1.28j-Hardcoded-Credential.html"
},
{
"name": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-021.txt",
"refsource": "MISC",
"url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-021.txt"
},
{
"name": "20190709 UPDATE: [SYSS-2019-021]: WolfVision Cynap - Use of Hard-coded Cryptographic Key (CWE-321) [CVE-2019-13352]",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2019/Jul/9"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-13352",
"datePublished": "2019-07-05T19:33:50.000Z",
"dateReserved": "2019-07-05T00:00:00.000Z",
"dateUpdated": "2024-08-04T23:49:24.830Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-70382 (GCVE-0-2026-70382)
Vulnerability from cvelistv5 – Published: 2026-10-26 19:59 – Updated: 2026-10-26 19:59
VLAI
EPSS
VEX
Title
Stored Cross-Site Scripting in Web Interface
Summary
Some externally supplied values stored by the device may be rendered in the web interface without sufficient output encoding. An attacker who can influence one of these values could cause script execution in the browser of a user who views an affected page. Exploitation requires an attacker to influence a stored value and a user to view a page that renders it.
Severity
4.1 (Medium)
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wolfvision.com/de/security/cve-2026-70382-1 | vendor-advisory |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| WolfVision | Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro |
Affected:
0 , < 1.78a
(custom)
|
|
| WolfVision | Cynap Pure (Next Gen), Cynap Bridge |
Affected:
0 , < 2.00d
(custom)
|
|
| WolfVision | Cynap Videobar |
Affected:
0 , < 1.72e
(custom)
|
|
| WolfVision | Cynap, Cynap Core, Cynap Pure SDM |
Affected:
0
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro",
"vendor": "WolfVision",
"versions": [
{
"lessThan": "1.78a",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cynap Pure (Next Gen), Cynap Bridge",
"vendor": "WolfVision",
"versions": [
{
"lessThan": "2.00d",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cynap Videobar",
"vendor": "WolfVision",
"versions": [
{
"lessThan": "1.72e",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "Cynap, Cynap Core, Cynap Pure SDM",
"vendor": "WolfVision",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "National Test Institute for Cybersecurity (NTC)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Some externally supplied values stored by the device may be rendered in the web interface without sufficient output encoding. An attacker who can influence one of these values could cause script execution in the browser of a user who views an affected page. Exploitation requires an attacker to influence a stored value and a user to view a page that renders it."
}
],
"value": "Some externally supplied values stored by the device may be rendered in the web interface without sufficient output encoding. An attacker who can influence one of these values could cause script execution in the browser of a user who views an affected page. Exploitation requires an attacker to influence a stored value and a user to view a page that renders it."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T19:59:46.065Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://wolfvision.com/de/security/cve-2026-70382-1"
}
],
"title": "Stored Cross-Site Scripting in Web Interface",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Until an update can be applied, consider the following measures where operationally feasible:\u003cbr\u003e\u003cul\u003e\u003cli\u003eRestrict access to the web management interfaces on TCP ports 80 and 443 to trusted hosts only.\u003c/li\u003e\u003c/ul\u003e\u003cul\u003e\u003cli\u003eAvoid opening or displaying content from untrusted sources on the device until it is updated.\u003c/li\u003e\u003c/ul\u003e\u003ci\u003eWolfVision recommends keeping devices up to date and using dedicated, managed network segments (VLAN or firewall zone) to restrict device access to trusted hosts only.\u003c/i\u003e\u003cbr\u003e"
}
],
"value": "Until an update can be applied, consider the following measures where operationally feasible:\n * Restrict access to the web management interfaces on TCP ports 80 and 443 to trusted hosts only.\n\n\n * Avoid opening or displaying content from untrusted sources on the device until it is updated.\n\n\nWolfVision recommends keeping devices up to date and using dedicated, managed network segments (VLAN or firewall zone) to restrict device access to trusted hosts only."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-70382",
"datePublished": "2026-10-26T19:59:46.065Z",
"dateReserved": "2026-08-04T07:41:00.082Z",
"dateUpdated": "2026-10-26T19:59:46.065Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70381 (GCVE-0-2026-70381)
Vulnerability from cvelistv5 – Published: 2026-10-26 19:52 – Updated: 2026-10-26 19:52
VLAI
EPSS
VEX
Title
Unauthorized Access to Internal Web Resources
Summary
An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be accessed remotely by an unauthenticated attacker with network access to the web interface.
The accessible resources do not expose credentials or provide administrative functionality, but may include non-public device content, such as screen-saver content or assets used by the web interface.
Severity
5.3 (Medium)
CWE
- CWE-290 - Authentication bypass by spoofing
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wolfvision.com/de/security/cve-2026-70381-1 | vendor-advisory |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| WolfVision | Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro |
Affected:
0 , < 1.78a
(custom)
|
|
| WolfVision | Cynap Pure (Next Gen), Cynap Bridge |
Affected:
0 , < 2.00d
(custom)
|
|
| WolfVision | Cynap Videobar |
Affected:
0 , < 1.72e
(custom)
|
|
| WolfVision | Cynap, Cynap Core, Cynap Pure SDM |
Affected:
0
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro",
"vendor": "WolfVision",
"versions": [
{
"lessThan": "1.78a",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cynap Pure (Next Gen), Cynap Bridge",
"vendor": "WolfVision",
"versions": [
{
"lessThan": "2.00d",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cynap Videobar",
"vendor": "WolfVision",
"versions": [
{
"lessThan": "1.72e",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "Cynap, Cynap Core, Cynap Pure SDM",
"vendor": "WolfVision",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "National Test Institute for Cybersecurity (NTC)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be accessed remotely by an unauthenticated attacker with network access to the web interface.\u003cbr\u003eThe accessible resources do not expose credentials or provide administrative functionality, but may include non-public device content, such as screen-saver content or assets used by the web interface.\u003cbr\u003e"
}
],
"value": "An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be accessed remotely by an unauthenticated attacker with network access to the web interface.\nThe accessible resources do not expose credentials or provide administrative functionality, but may include non-public device content, such as screen-saver content or assets used by the web interface."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication bypass by spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T19:52:44.232Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://wolfvision.com/de/security/cve-2026-70381-1"
}
],
"title": "Unauthorized Access to Internal Web Resources",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Until an update can be applied, consider the following measures where operationally feasible:\u003cbr\u003e\u003cul\u003e\u003cli\u003eRestrict network access to the web management interfaces on TCP ports 80 and 443 to trusted hosts only.\u003c/li\u003e\u003c/ul\u003e\u003ci\u003eWolfVision recommends keeping devices up to date and using dedicated, managed network segments (VLAN or firewall zone) to restrict device access to trusted hosts only.\u003c/i\u003e\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "Until an update can be applied, consider the following measures where operationally feasible:\n * Restrict network access to the web management interfaces on TCP ports 80 and 443 to trusted hosts only.\n\n\nWolfVision recommends keeping devices up to date and using dedicated, managed network segments (VLAN or firewall zone) to restrict device access to trusted hosts only."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-70381",
"datePublished": "2026-10-26T19:52:44.232Z",
"dateReserved": "2026-08-04T07:41:00.082Z",
"dateUpdated": "2026-10-26T19:52:44.232Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70380 (GCVE-0-2026-70380)
Vulnerability from cvelistv5 – Published: 2026-10-26 19:45 – Updated: 2026-10-26 19:45
VLAI
EPSS
VEX
Title
Resource Exhaustion in MICE Service
Summary
A denial-of-service vulnerability has been identified in the Miracast over Infrastructure Connection Establishment (MICE) service. An unauthenticated attacker with network access to the MICE service could consume available connection capacity, preventing legitimate users from establishing MICE-based Miracast connections while the condition persists.
Miracast P2P is not affected. MICE is disabled in the default configuration and must be explicitly enabled by the customer. On most devices, Miracast P2P is available independently of MICE, but a complete disruption of Miracast can occur on some devices when WLAN is configured for Infrastructure mode.
Severity
5.3 (Medium)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wolfvision.com/de/security/cve-2026-70380-1 | vendor-advisory |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| WolfVision | Cynap Pro, Cynap Core Pro, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro |
Affected:
0 , < 1.78a
(custom)
|
|
| WolfVision | Cynap Pure (Next Gen) |
Affected:
0 , < 2.00d
(custom)
|
|
| WolfVision | Cynap Videobar |
Affected:
0 , < 1.72e
(custom)
|
|
| WolfVision | Cynap, Cynap Core, Cynap Pure SDM |
Affected:
0
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cynap Pro, Cynap Core Pro, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro",
"vendor": "WolfVision",
"versions": [
{
"lessThan": "1.78a",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cynap Pure (Next Gen)",
"vendor": "WolfVision",
"versions": [
{
"lessThan": "2.00d",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cynap Videobar",
"vendor": "WolfVision",
"versions": [
{
"lessThan": "1.72e",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "Cynap, Cynap Core, Cynap Pure SDM",
"vendor": "WolfVision",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "National Test Institute for Cybersecurity (NTC)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A denial-of-service vulnerability has been identified in the Miracast over Infrastructure Connection Establishment (MICE) service. An unauthenticated attacker with network access to the MICE service could consume available connection capacity, preventing legitimate users from establishing MICE-based Miracast connections while the condition persists.\u003cbr\u003eMiracast P2P is not affected. MICE is disabled in the default configuration and must be explicitly enabled by the customer. On most devices, Miracast P2P is available independently of MICE, but a complete disruption of Miracast can occur on some devices when WLAN is configured for Infrastructure mode.\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "A denial-of-service vulnerability has been identified in the Miracast over Infrastructure Connection Establishment (MICE) service. An unauthenticated attacker with network access to the MICE service could consume available connection capacity, preventing legitimate users from establishing MICE-based Miracast connections while the condition persists.\nMiracast P2P is not affected. MICE is disabled in the default configuration and must be explicitly enabled by the customer. On most devices, Miracast P2P is available independently of MICE, but a complete disruption of Miracast can occur on some devices when WLAN is configured for Infrastructure mode."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T19:45:17.820Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://wolfvision.com/de/security/cve-2026-70380-1"
}
],
"title": "Resource Exhaustion in MICE Service",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Until an update can be applied, consider the following measures where operationally feasible:\u003cbr\u003e\u003cul\u003e\u003cli\u003eRestrict access to the MICE service on TCP port 7250 to trusted hosts only.\u003c/li\u003e\u003c/ul\u003eWolfVision recommends keeping devices up to date and using dedicated, managed network segments (VLAN or firewall zone) to restrict device access to trusted hosts only.\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "Until an update can be applied, consider the following measures where operationally feasible:\n * Restrict access to the MICE service on TCP port 7250 to trusted hosts only.\n\n\nWolfVision recommends keeping devices up to date and using dedicated, managed network segments (VLAN or firewall zone) to restrict device access to trusted hosts only."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-70380",
"datePublished": "2026-10-26T19:45:17.820Z",
"dateReserved": "2026-08-04T07:41:00.082Z",
"dateUpdated": "2026-10-26T19:45:17.820Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70379 (GCVE-0-2026-70379)
Vulnerability from cvelistv5 – Published: 2026-10-26 17:48 – Updated: 2026-10-26 17:48
VLAI
EPSS
VEX
Title
Unauthorized Access to vSolution Matrix RTSP
Summary
When the vSolution Matrix feature is enabled, affected devices may make current screen content available through an unauthenticated RTSP/RTP stream to hosts on the same network segment. The stream is not encrypted, which may allow an unauthenticated host to view or capture presentation content where network access is not otherwise restricted. This vulnerability only affects devices with the vSolution Matrix feature enabled.
Severity
CWE
- CWE-319 - Cleartext transmission of sensitive information
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wolfvision.com/de/security/cve-2026-70379-1 | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WolfVision | Cynap Pro, Cynap Core Pro |
Affected:
0 , < 1.78a
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cynap Pro, Cynap Core Pro",
"vendor": "WolfVision",
"versions": [
{
"lessThan": "1.78a",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "National Test Institute for Cybersecurity (NTC)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When the vSolution Matrix feature is enabled, affected devices may make current screen content available through an unauthenticated RTSP/RTP stream to hosts on the same network segment. The stream is not encrypted, which may allow an unauthenticated host to view or capture presentation content where network access is not otherwise restricted. This vulnerability only affects devices with the vSolution Matrix feature enabled.\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "When the vSolution Matrix feature is enabled, affected devices may make current screen content available through an unauthenticated RTSP/RTP stream to hosts on the same network segment. The stream is not encrypted, which may allow an unauthenticated host to view or capture presentation content where network access is not otherwise restricted. This vulnerability only affects devices with the vSolution Matrix feature enabled."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-319",
"description": "CWE-319 Cleartext transmission of sensitive information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T17:48:55.829Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://wolfvision.com/de/security/cve-2026-70379-1"
}
],
"title": "Unauthorized Access to vSolution Matrix RTSP",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Until an update can be applied, consider the following measures where operationally feasible:\u003cbr\u003e\u003cul\u003e\u003cli\u003eDisable the \"vSolution Matrix\" feature if it is not required.\u003c/li\u003e\u003cli\u003eRestrict vSolution Matrix to networks that contain only trusted Matrix stations.\u003c/li\u003e\u003c/ul\u003eIf network separation is not feasible, block the following on a firewall:\u003cul\u003e\u003cli\u003eInbound RTSP control: TCP 554 and 8554. The device redirects TCP 554 to 8554, and Matrix clients connect to 8554.\u003c/li\u003e\u003cli\u003eOutbound audio and video multicast from the device: UDP 5500-5503 by default.\u003c/li\u003e\u003cli\u003eOn Cynap Core and on Cynap Pro, also block inbound TCP 555 and 8555 and outbound UDP 5504-5507. These ports carry the second HDMI stream.\u003c/li\u003e\u003cli\u003eIf the multicast port base is not 5500 (see device settings), replace 5500-5503 with that base through base+3, and 5504-5507 with base+4 through base+7.\u003c/li\u003e\u003c/ul\u003eWolfVision recommends keeping devices up to date and using dedicated, managed network segments (VLAN or firewall zone) to restrict device access to trusted hosts only.\u003cbr\u003e"
}
],
"value": "Until an update can be applied, consider the following measures where operationally feasible:\n * Disable the \"vSolution Matrix\" feature if it is not required.\n * Restrict vSolution Matrix to networks that contain only trusted Matrix stations.\n\n\nIf network separation is not feasible, block the following on a firewall: * Inbound RTSP control: TCP 554 and 8554. The device redirects TCP 554 to 8554, and Matrix clients connect to 8554.\n * Outbound audio and video multicast from the device: UDP 5500-5503 by default.\n * On Cynap Core and on Cynap Pro, also block inbound TCP 555 and 8555 and outbound UDP 5504-5507. These ports carry the second HDMI stream.\n * If the multicast port base is not 5500 (see device settings), replace 5500-5503 with that base through base+3, and 5504-5507 with base+4 through base+7.\n\n\nWolfVision recommends keeping devices up to date and using dedicated, managed network segments (VLAN or firewall zone) to restrict device access to trusted hosts only."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-70379",
"datePublished": "2026-10-26T17:48:55.829Z",
"dateReserved": "2026-08-04T07:41:00.082Z",
"dateUpdated": "2026-10-26T17:48:55.829Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59107 (GCVE-0-2026-59107)
Vulnerability from cvelistv5 – Published: 2026-10-26 13:33 – Updated: 2026-10-26 13:33
VLAI
EPSS
VEX
Title
Shared SSH Authentication Key in vSolution Matrix File Sharing
Summary
A security vulnerability has been identified in the vSolution Matrix file sharing feature. A shared cryptographic trust configuration could allow an attacker who obtains the matching private key to authenticate to an affected device via SSH as root. This vulnerability affects only devices configured as a vSolution Matrix main/master station with the file sharing feature enabled.
Severity
9.8 (Critical)
CWE
- CWE-797 - Use of Hard-coded Credentials
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wolfvision.com/de/security/cve-2026-59107-1 | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| WolfVision | Cynap Pro, Cynap Core Pro |
Affected:
0 , < 1.78a
(custom)
|
|
| WolfVision | Cynap, Cynap Core |
Affected:
0
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cynap Pro, Cynap Core Pro",
"vendor": "WolfVision",
"versions": [
{
"lessThan": "1.78a",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "Cynap, Cynap Core",
"vendor": "WolfVision",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "National Test Institute for Cybersecurity (NTC)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A security vulnerability has been identified in the vSolution Matrix file sharing feature. A shared cryptographic trust configuration could allow an attacker who obtains the matching private key to authenticate to an affected device via SSH as root. This vulnerability affects only devices configured as a vSolution Matrix main/master station with the file sharing feature enabled."
}
],
"value": "A security vulnerability has been identified in the vSolution Matrix file sharing feature. A shared cryptographic trust configuration could allow an attacker who obtains the matching private key to authenticate to an affected device via SSH as root. This vulnerability affects only devices configured as a vSolution Matrix main/master station with the file sharing feature enabled."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-797",
"description": "CWE-797 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T13:33:12.851Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://wolfvision.com/de/security/cve-2026-59107-1"
}
],
"title": "Shared SSH Authentication Key in vSolution Matrix File Sharing",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Until an update can be applied, take the following measures where operationally feasible:\u003cbr\u003e\u003cul\u003e\u003cli\u003eDisable vSolution Matrix file sharing if the feature is not required.\u003c/li\u003e\u003cli\u003eRestrict access to the vSolution Matrix file sharing service on TCP port 50930 to trusted hosts only.\u003c/li\u003e\u003c/ul\u003eWolfVision recommends keeping devices up to date and using dedicated, managed network segments (VLAN or firewall zone) to restrict device access to trusted hosts only."
}
],
"value": "Until an update can be applied, take the following measures where operationally feasible:\n * Disable vSolution Matrix file sharing if the feature is not required.\n * Restrict access to the vSolution Matrix file sharing service on TCP port 50930 to trusted hosts only.\n\n\nWolfVision recommends keeping devices up to date and using dedicated, managed network segments (VLAN or firewall zone) to restrict device access to trusted hosts only."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-59107",
"datePublished": "2026-10-26T13:33:12.851Z",
"dateReserved": "2026-07-02T15:47:36.964Z",
"dateUpdated": "2026-10-26T13:33:12.851Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59106 (GCVE-0-2026-59106)
Vulnerability from cvelistv5 – Published: 2026-10-26 13:15 – Updated: 2026-10-26 15:35
VLAI
EPSS
VEX
Title
Unauthenticated RCE Vulnerability in WolfProt interface implementation
Summary
A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker with network access to a vulnerable service to execute operating-system commands with the privileges of the affected application service.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 15:04 UTC
CWE
- CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wolfvision.com/de/security/cve-2026-59106-2 | vendor-advisory |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| WolfVision | Cynap Pure (Next Gen), Cynap Bridge |
Affected:
0 , < 2.00c
(custom)
|
|
| WolfVision | Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro |
Affected:
0 , < 1.78a
(custom)
|
|
| WolfVision | Cynap Videobar, Firmware Version |
Affected:
0 , < 1.72e
(custom)
|
|
| WolfVision | Cynap, Cynap Core, Cynap Pure SDM |
Affected:
0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59106",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T15:04:38.018668Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T15:35:52.374Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cynap Pure (Next Gen), Cynap Bridge",
"vendor": "WolfVision",
"versions": [
{
"lessThan": "2.00c",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro",
"vendor": "WolfVision",
"versions": [
{
"lessThan": "1.78a",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cynap Videobar, Firmware Version",
"vendor": "WolfVision",
"versions": [
{
"lessThan": "1.72e",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "Cynap, Cynap Core, Cynap Pure SDM",
"vendor": "WolfVision",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "National Test Institute for Cybersecurity (NTC)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker with network access to a vulnerable service to execute operating-system commands with the privileges of the affected application service."
}
],
"value": "A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker with network access to a vulnerable service to execute operating-system commands with the privileges of the affected application service."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T13:15:02.436Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://wolfvision.com/de/security/cve-2026-59106-2"
}
],
"title": "Unauthenticated RCE Vulnerability in WolfProt interface implementation",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUntil an update can be applied, restrict network access to the \nWolfProt-related ports (TCP 50915 and 50917) as well as the web \nmanagement interfaces (TCP 80 and 443) to trusted hosts only. Note that \nthese services cannot be disabled. WolfVision recommends keeping devices up to date and using \ndedicated, managed network segments (VLAN or firewall zone) to restrict \ndevice access to trusted hosts only.\u003c/p\u003e"
}
],
"value": "Until an update can be applied, restrict network access to the \nWolfProt-related ports (TCP 50915 and 50917) as well as the web \nmanagement interfaces (TCP 80 and 443) to trusted hosts only. Note that \nthese services cannot be disabled. WolfVision recommends keeping devices up to date and using \ndedicated, managed network segments (VLAN or firewall zone) to restrict \ndevice access to trusted hosts only."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-59106",
"datePublished": "2026-10-26T13:15:02.436Z",
"dateReserved": "2026-07-02T15:47:36.964Z",
"dateUpdated": "2026-10-26T15:35:52.374Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2019-13352 (GCVE-0-2019-13352)
Vulnerability from cvelistv5 – Published: 2019-07-05 19:33 – Updated: 2024-08-04 23:49
VLAI
EPSS
VEX
Summary
WolfVision Cynap before 1.30j uses a static, hard-coded cryptographic secret for generating support PINs for the 'forgot password' feature. By knowing this static secret and the corresponding algorithm for calculating support PINs, an attacker can reset the ADMIN password and thus gain remote access.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://packetstormsecurity.com/files/153530/WolfV… | x_refsource_MISC |
| https://www.syss.de/fileadmin/dokumente/Publikati… | x_refsource_MISC |
| http://seclists.org/fulldisclosure/2019/Jul/9 | mailing-listx_refsource_FULLDISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T23:49:24.830Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/153530/WolfVision-Cynap-1.18g-1.28j-Hardcoded-Credential.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-021.txt"
},
{
"name": "20190709 UPDATE: [SYSS-2019-021]: WolfVision Cynap - Use of Hard-coded Cryptographic Key (CWE-321) [CVE-2019-13352]",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2019/Jul/9"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "WolfVision Cynap before 1.30j uses a static, hard-coded cryptographic secret for generating support PINs for the \u0027forgot password\u0027 feature. By knowing this static secret and the corresponding algorithm for calculating support PINs, an attacker can reset the ADMIN password and thus gain remote access."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-07-10T17:06:05.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/153530/WolfVision-Cynap-1.18g-1.28j-Hardcoded-Credential.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-021.txt"
},
{
"name": "20190709 UPDATE: [SYSS-2019-021]: WolfVision Cynap - Use of Hard-coded Cryptographic Key (CWE-321) [CVE-2019-13352]",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2019/Jul/9"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-13352",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "WolfVision Cynap before 1.30j uses a static, hard-coded cryptographic secret for generating support PINs for the \u0027forgot password\u0027 feature. By knowing this static secret and the corresponding algorithm for calculating support PINs, an attacker can reset the ADMIN password and thus gain remote access."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://packetstormsecurity.com/files/153530/WolfVision-Cynap-1.18g-1.28j-Hardcoded-Credential.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/153530/WolfVision-Cynap-1.18g-1.28j-Hardcoded-Credential.html"
},
{
"name": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-021.txt",
"refsource": "MISC",
"url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-021.txt"
},
{
"name": "20190709 UPDATE: [SYSS-2019-021]: WolfVision Cynap - Use of Hard-coded Cryptographic Key (CWE-321) [CVE-2019-13352]",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2019/Jul/9"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-13352",
"datePublished": "2019-07-05T19:33:50.000Z",
"dateReserved": "2019-07-05T00:00:00.000Z",
"dateUpdated": "2024-08-04T23:49:24.830Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}