WeenyGenius CVE-2026-89178

Exploitation requires the attacker to be physically or logically present on the same Layer 2 broadcast domain as the student computers - for example, connected to the same school switch VLAN. No authentication, privileges, or user interaction are required. The WeenyGenius student client must be running and listening for teacher broadcasts, which is the default operational state during lab sessions. Exploitation is fundamentally constrained to the local network segment; an internet-facing attacker cannot reach broadcast packets. The attack is further scoped to environments where WeenyGenius is deployed and actively running on student machines.

The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) accurately characterizes the threat: no authentication, no special configuration, no user interaction required - only Layer 2 network adjacency. The full-impact triad (VC:H/VI:H/VA:H) is consistent with the described attack outcome where student machines initiate management sessions with the attacker, likely granting teacher-level capabilities such as screen observation, remote command dispatch, or session lock. Even a mid-sized municipal IT team in leszno managing a handful of computer labs should treat this as urgent, since any student with a laptop on the school LAN is a potential attacker. No public exploit has been identified at time of analysis, and the product's niche footprint limits broader cross-organization risk; however, within affected educational environments the practical risk is high because the attack requires no resources beyond LAN adjacency. EPSS data is not present in the input; exploitation probability is inferred as moderate given trivial complexity but limited deployment scale.

A student or other insider connected to the school LAN crafts a spoofed WeenyGenius teacher-beacon broadcast packet and transmits it from their own laptop. Student computers on the same network segment receive the packet, perform no origin validation, and initiate management connections to the attacker's machine. The attacker then holds teacher-level management authority over enrolled student workstations without any credentials.