WOLFVISON Cynap EUVD-2026-110302

The device's web interface must be network-reachable from the attacker; exploitation then requires no authentication, no user interaction, and no non-default configuration (AV:N/AC:L/PR:N/UI:N) - the access-control check that should restrict certain resources to on-device use fails for remote requests. Exploitation is inherently LIMITED in scope: the exposed resources are non-public device content such as screen-saver content or web-interface assets, and per the vendor they do NOT expose credentials or provide administrative functionality. The practical limiting factor is network exposure of the Cynap web interface - devices segmented away from untrusted networks are not remotely reachable. Fixed firmware: Cynap Pro/Core Pro/Receiver/Pure/Pure Mini/Pure Pro in 1.78a; Cynap Videobar in 1.72e; Cynap Pure (Next Gen)/Cynap Bridge in 2.00d; the Cynap/Cynap Core/Cynap Pure SDM branch is listed affected with no fixed version in the sources.

This is a moderate-severity information-exposure issue that the signals consistently rank as a measured, non-emergency priority rather than a crisis. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity flaw needing no privileges or user interaction, but the scored impact is deliberately small - the only non-zero metric is VA:L, with VC:N and VI:N. That scored vector is internally inconsistent with the description: the text describes unauthorized READ access to non-public device content (screen-saver content, web-interface assets), which is a confidentiality exposure (normally VC:L), yet the vector records VC:N and instead marks availability (VA:L); this VC:N-vs-description mismatch should be verified with WolfVision. EPSS is low at 0.26% (17th percentile), there is no CISA KEV listing, and no public exploit or PoC reference is present in the input, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month' (not act_now/emergency), and a vendor patch is available. Taken together, the signals agree: network-reachable and easy to trigger, but limited blast radius (no credentials, no admin functionality) and no evidence of exploitation - a patch-in-routine-cycle item, not a high-CVSS-but-false-alarm nor an active threat.

An unauthenticated attacker with network reachability to a Cynap device's web interface requests resources that the firmware intended to serve only to the local device, and the server returns them despite the request originating remotely. No exploit code is identified in the sources; the realistic outcome is disclosure of non-public device assets (e.g., screen-saver content or web-interface assets), not credential theft or administrative control.