WeenyGenius CVE-2026-89176

Exploitation requires the attacker to be on the same local network segment (LAN or WLAN broadcast domain) as the WeenyGenius deployment - this adjacency requirement (AV:A) is the primary and only meaningful barrier. Once on the network, no authentication, no elevated privileges, and no user interaction are required. Teacher-role impersonation, which yields remote control over student endpoints, requires only that the attacker understand or reverse the WeenyGenius endpoint-announcement protocol; student-role spoofing produces operational disruption. Exploitation is limited to environments where WeenyGenius is actively running and student or teacher computers are reachable on the same segment as the attacker.

The CVSS 4.0 score of 8.7 with AV:A accurately captures the primary limiting factor: the attacker must share the same LAN or WLAN segment as the lab. Within that boundary, however, complexity is negligible (AC:L, AT:N, PR:N, UI:N), and all three impact dimensions are rated High (VC:H/VI:H/VA:H). No EPSS score is available in the provided intelligence and the vulnerability does not appear in CISA's KEV catalog, suggesting it has not yet seen broad automated exploitation. No proof-of-concept has been identified. Despite these signals, even a mid-sized municipal IT team in walbrzych managing shared school computer labs should treat this as urgent given that attackers need only network adjacency - a condition easily met by students, guests, or anyone on the same Wi-Fi - to silently assume teacher authority and control every workstation in the classroom with no prior credentials or user interaction.

An attacker connects to the school lab network - via physical access, a guest Wi-Fi segment with layer-2 visibility, or a compromised lab machine - and begins broadcasting unauthenticated WeenyGenius teacher-role announcements. Student workstations, following the protocol without any credential check, accept the spoofed teacher authority and initiate management connections back to the attacker's host. The attacker thereby gains interactive remote control over all student endpoints in the classroom without any exploit code beyond protocol knowledge.