EUVD-2026-76004
GHSA-35jr-c9gf-7v8m
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-network position required (AV:A); no authentication or interaction needed; full triad impact from eavesdropping (C:H) and unauthenticated command replay (I:H/A:H); no scope change.
Primary rating from Vendor (twcert).
CVSS VectorVendor: twcert
Lifecycle Timeline
2DescriptionCVE.org
WeenyGenius, a computer lab management system by Howyar Technologies, has a Use of Insecure Protocol vulnerability. Due to the reliance on ZMTP Null mode, unauthenticated attackers on the same network can capture packets to leak transmitted data, or perform replay attacks with forged commands to disrupt classroom operations.
AnalysisAI
WeenyGenius computer lab management software by Howyar Technologies transmits control commands over ZMTP Null mode - ZeroMQ's no-authentication, no-encryption transport - leaving all management traffic exposed on the local network. Unauthenticated adjacent-network attackers can passively capture plaintext session data or actively replay forged classroom commands to disrupt exams and lesson control. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must have adjacent network access - on the same LAN switch segment or WLAN as the WeenyGenius teacher console or managed student endpoints; the CVSS AV:A metric confirms this requirement. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) correctly reflects full confidentiality, integrity, and availability impact but is bounded by the adjacent-network requirement. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch or fixed version number has been identified at time of analysis; consult the TWCERT advisory at https://www.twcert.org.tw/en/cp-139-11200-ffc3c-2.html for updated vendor guidance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems running WeenyGenius and their network locations; immediately implement network segmentation to isolate lab management traffic on a restricted VLAN separate from general institutional networks; begin real-time monitoring of lab management segments for suspicious traffic patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Weenygenius
View allWeenyGenius, a computer lab management system by Howyar Technologies, exposes its endpoint communication protocol withou
Origin validation failure in WeenyGenius, Howyar Technologies' computer lab management system, allows any unauthenticate
Replay attack vulnerability in WeenyGenius, a computer lab management system by Howyar Technologies, allows unauthentica
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today