WeenyGenius EUVD-2026-76004

Attacker must have adjacent network access - on the same LAN switch segment or WLAN as the WeenyGenius teacher console or managed student endpoints; the CVSS AV:A metric confirms this requirement. No authentication is required (PR:N) and no user interaction is needed (UI:N). The vulnerability is present whenever WeenyGenius is actively running and communicating, as ZMTP Null mode appears to be the default transport configuration. Exploitation is strictly limited by network adjacency: remote internet-based attackers cannot exploit this without first obtaining a foothold on the local school network.

The CVSS 4.0 score of 8.7 (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) correctly reflects full confidentiality, integrity, and availability impact but is bounded by the adjacent-network requirement. In a school setting this boundary is realistic to cross: students on shared classroom WiFi or wired lab ports are inherently adjacent. No EPSS data was provided and the vulnerability is absent from CISA KEV, so no evidence of active or widespread exploitation exists. The zero-complexity prerequisites (AC:L/AT:N/PR:N) make exploitation straightforward for anyone already on the right segment, removing practical barriers beyond network position. The integrity vector (VI:H via replay) arguably represents a higher operational risk than passive data capture alone, as forged commands can actively sabotage graded examinations or teacher-controlled sessions.

A student connected to the classroom WiFi opens Wireshark and captures unencrypted ZMTP NULL frames exchanged between the teacher console and student workstations during a live session. The student identifies a 'lock workstation' command frame and replays it - without modification - against a peer's machine at a critical moment during an examination, locking them out. No credentials or custom exploit code are required beyond standard network capture utilities.