EUVD-2026-76003
GHSA-mh39-5w93-gwqv
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-only attack vector is the sole constraint; no privileges or interaction required, with full C/I/A impact confined to the WeenyGenius lab management system.
Primary rating from Vendor (twcert).
CVSS VectorVendor: twcert
Lifecycle Timeline
2DescriptionCVE.org
WeenyGenius, a computer lab management system developed by Howyar Technologies, has a Missing Authentication vulnerability. Unauthenticated attackers on the same network can easily spoof student or teacher endpoints. Impersonating a student can disrupt normal classroom operations, whereas impersonating a teacher can induce student computers to initiate connections, thereby gaining remote control over the student endpoints.
AnalysisAI
WeenyGenius, a computer lab management system by Howyar Technologies, exposes its endpoint communication protocol without any authentication, allowing any adjacent-network attacker to impersonate either student or teacher roles. The teacher-impersonation path is the critical vector: posing as a teacher causes student workstations to initiate management connections back to the attacker, yielding remote control over every student endpoint in the lab. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be on the same local network segment (LAN or WLAN broadcast domain) as the WeenyGenius deployment - this adjacency requirement (AV:A) is the primary and only meaningful barrier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 with AV:A accurately captures the primary limiting factor: the attacker must share the same LAN or WLAN segment as the lab. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the TWCERT English advisory at https://www.twcert.org.tw/en/cp-139-11200-ffc3c-2.html for vendor-issued patch guidance; no confirmed patched version number is available in the current intelligence data, so upgrading to any vendor-recommended release should be the first action once one is identified. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Immediately restrict network access to WeenyGenius-managed lab segments by implementing layer 2/3 isolation from general infrastructure and guest networks; disable unnecessary remote management protocols if the system allows. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Weenygenius
View allOrigin validation failure in WeenyGenius, Howyar Technologies' computer lab management system, allows any unauthenticate
WeenyGenius computer lab management software by Howyar Technologies transmits control commands over ZMTP Null mode - Zer
Replay attack vulnerability in WeenyGenius, a computer lab management system by Howyar Technologies, allows unauthentica
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today