WeenyGenius CVE-2026-89179

Exploitation requires the attacker to be on the same adjacent network segment as the target student workstation - for example, connected to the same classroom LAN or Wi-Fi SSID. No authentication, credentials, or elevated privileges are required. The attacker must be able to passively capture network traffic (e.g., via ARP spoofing or a promiscuous-mode NIC on a shared medium). Exploitation is limited to integrity spoofing of presence/attendance status; it does not grant system access, credential exposure, or code execution. The attack does not work over the internet or from remote network segments, significantly narrowing the threat model to insider or co-located adversaries.

The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N) correctly scopes this as an adjacent-network, low-complexity integrity issue with no confidentiality or availability impact. Real-world risk is constrained by the AV:A requirement: an attacker must be on the same local network segment as the victim student, limiting exploitation to campus or lab environments where an adversarial party is physically or logically co-located. The impact is restricted to integrity manipulation - specifically, deceiving the teacher/management console about a student's connection status - and does not enable remote code execution, credential theft, or service disruption. The 'Information Disclosure' tag in the input metadata conflicts with the CVSS VC:N metric and the replay-spoofing mechanism; there is no evidence of confidentiality impact. No KEV listing and no EPSS score are available, consistent with a low-urgency, niche-product finding. This is a real but low-severity issue appropriate for prioritization behind network-layer mitigations rather than emergency patching.

An attacker - such as a student or outside party connected to the same lab network segment - uses a packet capture tool to record the connection-keepalive packet their own or another student's workstation sends to the WeenyGenius server. After the student logs off or leaves, the attacker replays the captured packet periodically, causing the teacher's management console to continue reporting the student as present and connected. No public exploit code has been identified at time of analysis.