WolfVision Cynap EUVD-2026-109816

No special conditions beyond network reachability - remote unauthenticated command injection against the WolfProt interface of affected WolfVision Cynap devices (per AV:N/AC:L/PR:N/UI:N and the vendor description of an unauthenticated network attacker). The practical limiting factor is network exposure of the WolfProt service: the device must be reachable by the attacker (for example on a management or meeting-room network), so devices not exposed to attacker-reachable networks are not exploitable. The available sources do not state a required non-default configuration or feature flag, and the specific input field or WolfProt command carrying the injection is not described in the supplied data.

Multiple signals align toward genuine high priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation requiring no user interaction, and the high vulnerable-system impact (VC:H/VI:H/VA:H) is consistent with CWE-78 OS command injection yielding full command execution at the service's privilege level. The vuln.today Decision label is 'act_now', and the issue was reported by ENISA, lending institutional weight to the assessment. These severity and decision signals reinforce each other. However, several exploitation-maturity signals are absent from the input: there is no CISA KEV entry, no EPSS probability, and no PoC or exploit reference - therefore this is 'no public exploit identified at time of analysis', and active exploitation cannot be claimed. The net picture is a credible, easily exploitable unauthenticated RCE on a specialist AV appliance whose real-world mass-exploitation likelihood is unquantified because EPSS is missing; the 'act_now' label here reflects intrinsic severity and unauthenticated network reach rather than observed in-the-wild activity. No conflict exists between the CVSS vector and the description - both describe unauthenticated network command execution.

An attacker with network access to a reachable WolfVision Cynap device sends crafted input to the WolfProt control interface that is insufficiently neutralized, causing the device to execute attacker-supplied operating-system commands as the affected application service. Because no authentication or user interaction is required (PR:N/UI:N) and complexity is low (AC:L), any attacker able to reach the service port can attempt this directly. No public exploit code is identified at time of analysis, so exploitation would require the attacker to craft the injection themselves.