WolfVision Cynap CVE-2026-70382

Exploitation requires two specific preconditions drawn from the description: (1) the attacker must be able to influence one of the externally-supplied values the device stores (the CVSS PR:L confirms this needs some level of privilege/access, so it is authenticated per the vector), and (2) a user must subsequently load the web interface page that renders that stored value without sufficient output encoding (UI:P - passive victim interaction). The limiting factors are therefore the need for prior write/influence access to a stored field, dependence on a victim viewing the specific affected page, and the affected version being below the fixed releases (Cynap Videobar 1.72e, main Cynap Pro/Pure family 1.78a, Cynap Pure Next Gen/Cynap Bridge 2.00d). This is a stored XSS, not remote unauthenticated code execution.

This is a stored cross-site scripting flaw (CWE-79) in the web interface of WolfVision Cynap device family, and the combined signals point to a genuine-but-moderate priority rather than an emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) indicates network reach with low attacker complexity, but exploitation is gated by two real constraints: the attacker must already hold some privilege to influence a stored value (PR:L), and a legitimate user must then view the page that renders it (UI:P / passive interaction). EPSS is low at 0.25% (17th percentile), there is no CISA KEV listing and no public exploit reference in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_month', consistent with a medium-severity (5.1) issue that has a patch available but no exploitation pressure - act on a normal patch cycle, not as an incident. One signal worth flagging: the vendor scored impact as VC:N/VI:N/VA:L (a low availability impact only, no confidentiality or integrity), which is unusual for script-execution XSS where the typical impact is to the confidentiality/integrity of the viewing user's session; this impact mapping should be verified against the vendor advisory.

A low-privileged user (or an external party able to influence a value the device stores) submits input containing script markup that the device saves without sufficient output encoding. When an administrator or another user later opens the web interface page that renders that stored value, the script executes in their browser session in the context of the device UI. No public exploit code is identified at time of analysis, and success depends on the victim viewing the affected page.