WiFiman Desktop CVE-2026-119249

The host must be running WiFiman Desktop for macOS with its local service bound to an unrestricted IP address (all interfaces / 0.0.0.0) instead of the loopback interface, which is the core defect (CWE-1327); the attacker must have network reachability to that listening service. Per the CVSS vector (PR:N/UI:N) no authentication and no user interaction are required once the attacker can reach the port. The principal limiting factor is network position: the description's phrasing ('access to the network') indicates the attacker generally needs to be on the same local network segment as the running macOS host, and WiFiman Desktop must be actively running with the vulnerable service active. Impact is limited to disclosure of host device information (C:H, no integrity or availability impact).

The supplied CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5 HIGH) describes a network-reachable, low-complexity, unauthenticated flaw with no user interaction, confined to confidentiality (information disclosure only - I:N/A:N). CWE-1327 (Binding to an Unrestricted IP Address) plus the description ('a malicious actor with access to the network') indicates the WiFiman Desktop service listens on all interfaces rather than loopback, exposing it to other hosts. However, the real-world risk signals are weaker than the 7.5 suggests: no EPSS score was provided, the CVE is NOT in CISA KEV, and no PoC or exploit reference is supplied, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a notable but non-emergency issue. Note a tension to verify with the vendor: the CVSS marks AV:N (full network) while the description emphasizes 'access to the network,' which for a desktop application typically means the attacker must share the victim's local/LAN segment (closer to AV:A) - this narrows the realistic attacker population. Overall this is a moderate-priority confidentiality exposure driven by a configuration/binding defect, not a high-urgency widely-exploited threat.

An attacker who is already on the same network as a macOS host running WiFiman Desktop scans for the service, which (per CWE-1327) is bound to an unrestricted address reachable from other hosts rather than only localhost. Because the CVSS vector is PR:N/UI:N, the attacker connects without authentication or any user action and queries the exposed service to obtain information about the host device. No public PoC or exploit code is referenced in the available data.