Vivo PcSuite EUVD-2026-36392

The attacker must be positioned on an adjacent network segment, Bluetooth range, or shared USB topology - remote internet-based exploitation is not possible per AV:A. The specific PcSuite feature associated with the connection confirmation pop-up must be active and in a connection-negotiation state on the target machine. No authentication credentials are required (PR:N) and no victim interaction beyond running the software is needed (UI:N). Exploitation is limited by physical or network proximity: the attacker cannot operate from an arbitrary internet location. The wildcard CPE indicates no version is known to be safe; however, impact is constrained to low integrity on the vulnerable system only, with no confidentiality or availability consequences confirmed.

The CVSS 4.0 score of 5.3 (Medium) reflects a constrained threat profile: adjacent network positioning (AV:A) limits the attack surface to physically or logically proximate adversaries, and the impact is bounded to low integrity (VI:L) with no confidentiality or availability consequences. There is no CISA KEV listing and no publicly known proof-of-concept exploit, both of which reduce operational urgency. The absence of privilege requirements (PR:N) and user interaction (UI:N) means an attacker within range faces no additional friction once positioned - this is the most concerning signal, as it implies the bypass is reliable and requires no social engineering. EPSS data was not provided; given the adjacent-only vector and limited impact, widespread automated exploitation is unlikely, but targeted abuse in enterprise or shared-network scenarios (e.g., corporate Wi-Fi, USB charging stations) is plausible. The wildcard CPE version string indicates no specific version range has been bounded - all deployed instances should be treated as potentially vulnerable until a patched version is confirmed.

An attacker on the same local network, Bluetooth range, or USB infrastructure as a target running Vivo PcSuite initiates a connection request to the application and manipulates the inputs that the confirmation pop-up relies upon to make its trust decision, causing the dialog to be bypassed without user acknowledgment. The attacker thereby establishes an unauthorized connection to the device, enabling whatever data or control operations the connected feature permits. No public proof-of-concept is known at time of analysis, but the low complexity and absence of required privileges suggest the bypass technique would be straightforward to reproduce once identified.