vSolution Matrix CVE-2026-59107

Exploitation requires that the target device be configured specifically as a vSolution Matrix main/master station AND that the file sharing feature be enabled - this is not a default state, which materially limits the exposed population. The attacker must additionally obtain the matching private key from the shared cryptographic trust configuration before authenticating; this key-acquisition prerequisite is what CVSS 4.0 encodes as AT:P. Given PR:N and UI:N in the supplied vector, no legitimate device credentials or victim interaction are needed once the key is held, and access is achieved remotely over SSH as root. The shared nature of the trust means a single recovered key may be reusable across multiple affected master stations.

Multiple signals converge on high priority. The vuln.today decision label is act_now, and the vendor-supplied CVSS 4.0 base score is 9.2 (Critical) with network vector (AV:N), low attack complexity (AC:L), no privileges (PR:N), no user interaction (UI:N), and full confidentiality/integrity/availability impact on the vulnerable system (VC:H/VI:H/VA:H) - consistent with SSH access as root. The one tempering metric is AT:P (Attack Requirements: Present), which reflects the description's prerequisite that the attacker first obtain the matching private key from the shared cryptographic trust configuration, and the fact that only devices configured as a vSolution Matrix main/master station with file sharing enabled are affected. Key data is MISSING and should be stated plainly: no EPSS exploitation-probability score is provided, the CVE is NOT listed in CISA KEV in the supplied data, and no proof-of-concept or exploit reference is present - only a WolfVision vendor advisory. So despite the act_now label and Critical score, there is no evidence of active exploitation or public exploit code at time of analysis; the urgency rests on the severity of outcome (unauthenticated root) and the shared-key design flaw rather than on observed attacks. Note also that the input Tags characterize this as 'Information Disclosure,' which understates the impact - successful exploitation yields root SSH access (full device compromise), not merely disclosure.

An attacker who extracts or otherwise obtains the shared private key corresponding to the device's cryptographic trust configuration connects over the network via SSH to a device acting as a vSolution Matrix main/master station with file sharing enabled, and authenticates directly as root. No public exploit code is identified at time of analysis; because the trust is shared, one recovered key may unlock multiple affected devices, though the attack requires that key to be obtained first (CVSS AT:P).