WolfVision Cynap EUVD-2026-110080

Exploitation requires that the MICE (Miracast over Infrastructure Connection Establishment) service be explicitly enabled by the customer - it is disabled in the default configuration, so default deployments are not exposed. Given CVSS PR:N/UI:N, no authentication or user interaction is required once MICE is reachable, and the attacker needs only network access to the MICE service to saturate its connection capacity. Impact is limited to denial of service and persists only while the attack continues; Miracast P2P is explicitly not affected and remains available independently of MICE on most devices. The main limiting factors are the non-default MICE configuration and network reachability to the service; a complete Miracast disruption only occurs on some devices when WLAN is configured for Infrastructure mode.

This is a genuine but modest-priority availability issue, not a high-impact emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated condition, but the only impact metric set is VA:L - availability-low, with no confidentiality (VC:N) or integrity (VI:N) effect and no scope change to other systems - which caps severity at 6.9. CWE-400 (uncontrolled resource consumption) matches the description: an attacker exhausts MICE connection capacity to block legitimate Miracast-over-Infrastructure connections only while the attack persists; there is no indication of code execution, data exposure, or lasting state corruption. The exploitation signals reinforce a measured response: EPSS is 0.31% (23rd percentile), the CVE is not listed in CISA KEV, and no public exploit is referenced, so there is no public exploit identified at the time of analysis. These signals are mutually consistent (low probability, no active exploitation, no PoC), so there is no conflict to flag - the vuln.today 'this_month' decision label fits a patchable, low-footprint DoS rather than an act-now scenario. The principal real-world limiter is that MICE is disabled by default and must be explicitly enabled by the customer, which sharply narrows the exposed population. Note one caveat: CVSS AV:N/PR:N describes network-reachable unauthenticated severity but does not encode the non-default-configuration prerequisite, so the raw vector overstates exposure for default deployments - verify MICE enablement before prioritizing.

An attacker with network reachability to a WolfVision Cynap device that has the optional MICE service enabled repeatedly opens or holds MICE connections to consume the service's finite connection capacity. Legitimate users are then unable to establish Miracast-over-Infrastructure sessions for the duration of the attack, and on some devices configured for WLAN Infrastructure mode this can disrupt Miracast entirely. No public exploit is identified at the time of analysis, and the attack requires that the non-default MICE service first be enabled.