CAYIN CMS EUVD-2026-66343

No special conditions beyond network reachability to the CAYIN CMS-WS or CMS-SE web interface - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation against default configurations. The specific limiting factor is functional scope: only media file list retrieval is exposed without authentication; the vulnerability does not provide write access, credential disclosure, or administrative control. Exploitation is further limited by the niche deployment footprint of CAYIN digital signage products, which are typically found in enterprise or public-display environments rather than general IT infrastructure.

The CVSS 3.1 base score of 5.3 (Medium) is consistent with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, reflecting a low-complexity, unauthenticated network attack with limited confidentiality impact and no integrity or availability impact. EPSS data was not provided, and the absence of a KEV entry and any POC reference suggests exploitation is not currently widespread. The realistic risk is constrained by the narrow impact - exposure of media file lists is useful for reconnaissance (understanding what content is deployed) but does not yield credentials, configuration, or administrative access. Defenders should nonetheless treat internet-facing CMS-WS and CMS-SE instances as a higher priority, since media file enumeration can support follow-on social engineering or targeted attacks against operators. No conflicting signals are present in the available data, though EPSS and KEV status remain unconfirmed due to absence from the source intelligence.

An unauthenticated attacker with HTTP access to a CAYIN CMS-WS or CMS-SE instance sends a crafted request to the unauthenticated media listing endpoint, receiving a structured list of media files managed by the signage system. No public exploit code has been identified, but the attack requires only a standard HTTP client and knowledge of the endpoint path, making it low-effort once the endpoint is identified through documentation or scanning.