EUVD-2026-76005
GHSA-43v7-686m-8j6r
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-network, no credentials or interaction required; full CIA impact on student workstations that establish management sessions with the spoofed teacher.
Primary rating from Vendor (twcert).
CVSS VectorVendor: twcert
Lifecycle Timeline
3DescriptionCVE.org
WeenyGenius, a computer lab management system by Howyar Technologies, has an Origin Validation Error vulnerability. Unauthenticated attackers on the same network can spoof the teacher workstation and send broadcast packets, causing student computers to attempt to establish a connection with the attacker.
AnalysisAI
Origin validation failure in WeenyGenius, Howyar Technologies' computer lab management system, allows any unauthenticated attacker adjacent to the school network to impersonate the teacher workstation by sending spoofed broadcast packets. Student machines running the WeenyGenius client accept these packets without verifying their source, causing them to initiate management connections to the attacker's host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be physically or logically present on the same Layer 2 broadcast domain as the student computers - for example, connected to the same school switch VLAN. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) accurately characterizes the threat: no authentication, no special configuration, no user interaction required - only Layer 2 network adjacency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the TWCERT advisories at https://www.twcert.org.tw/en/cp-139-11200-ffc3c-2.html for any patch released by Howyar Technologies; no specific fixed version is cited in currently available data, so patch availability should be confirmed directly with the vendor. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all WeenyGenius deployments in your school district and identify which network segments and student device populations are affected by the vulnerability. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Weenygenius
View allWeenyGenius, a computer lab management system by Howyar Technologies, exposes its endpoint communication protocol withou
WeenyGenius computer lab management software by Howyar Technologies transmits control commands over ZMTP Null mode - Zer
Replay attack vulnerability in WeenyGenius, a computer lab management system by Howyar Technologies, allows unauthentica
Share
External POC / Exploit Code
Leaving vuln.today