Cynap Cynap Core Cynap Pure Sdm
Monthly
Unauthenticated OS command injection in the WolfProt interface of WolfVision Cynap collaboration devices allows a remote attacker who can reach the service to run arbitrary operating-system commands at the privilege level of the Cynap application service. The flaw is rated 9.3 (CVSS 4.0: AV:N/AC:L/AT:N/PR:N/UI:N, with high confidentiality, integrity and availability impact) and maps to CWE-78; the vulnerable surface spans the Cynap, Cynap Core, Cynap Core Pro, Cynap Pro, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro, Cynap Pure Next Gen, Cynap Pure SDM, Cynap Receiver, Cynap Bridge and Cynap Videobar firmware lines. Per the supplied intelligence the decision is act_now; no public exploit code and no confirmed active exploitation were reported in the available data. The practical exposure gate is network reachability of the WolfProt service, so devices reachable from management or meeting-room networks carry the most risk.
Stored cross-site scripting in the web interface of WolfVision Cynap collaboration devices allows an attacker who can influence a stored, externally supplied value to execute script in the browser of another user who later views the page rendering that value. The flaw affects the Cynap Videobar (before 1.72e), the Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini and Cynap Pure Pro family (before 1.78a), and Cynap Pure (Next Gen) and Cynap Bridge (before 2.00d), with Cynap, Cynap Core and Cynap Pure SDM also listed by the EUVD record. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) the attacker needs some level of authenticated access to write the value and the victim must be induced to load the affected page, so this is stored XSS rather than unauthenticated remote code execution; no public exploit has been identified at time of analysis and EPSS is low at 0.25% (17th percentile).
Unauthenticated information exposure in WOLFVISON Cynap collaboration and presentation devices allows anyone who can reach the web interface to retrieve resources that should only be reachable locally on the device, including screen-saver content and web-interface assets. The flaw stems from a broken access-control check for remote requests and affects Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro before 1.78a, Cynap Videobar before 1.72e, and Cynap Pure (Next Gen) and Cynap Bridge before 2.00d, with the Cynap/Cynap Core/Cynap Pure SDM line listed as affected without a fixed version in the available sources. Per the vendor the exposed resources carry no credentials and no administrative capability, EPSS is low at 0.26% (17th percentile), and no public exploit or active exploitation is indicated, so priority is rated this_month rather than urgent.
Connection-capacity exhaustion in the MICE (Miracast over Infrastructure Connection Establishment) service on WolfVision Cynap collaboration devices lets an unauthenticated remote attacker with network reachability to that service occupy its available connection slots, so legitimate users cannot establish MICE-based Miracast sessions while the condition persists. Exposure is bounded: MICE is disabled in the default configuration and must be explicitly enabled by the customer, and Miracast P2P is unaffected and remains available independently of MICE on most devices, although a complete Miracast disruption can occur on some units when WLAN is configured for Infrastructure mode. EPSS is 0.31% (23rd percentile), no public exploit has been identified at time of analysis, and vendor patches are available for the version branches that list fixed releases.
Unauthenticated OS command injection in the WolfProt interface of WolfVision Cynap collaboration devices allows a remote attacker who can reach the service to run arbitrary operating-system commands at the privilege level of the Cynap application service. The flaw is rated 9.3 (CVSS 4.0: AV:N/AC:L/AT:N/PR:N/UI:N, with high confidentiality, integrity and availability impact) and maps to CWE-78; the vulnerable surface spans the Cynap, Cynap Core, Cynap Core Pro, Cynap Pro, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro, Cynap Pure Next Gen, Cynap Pure SDM, Cynap Receiver, Cynap Bridge and Cynap Videobar firmware lines. Per the supplied intelligence the decision is act_now; no public exploit code and no confirmed active exploitation were reported in the available data. The practical exposure gate is network reachability of the WolfProt service, so devices reachable from management or meeting-room networks carry the most risk.
Stored cross-site scripting in the web interface of WolfVision Cynap collaboration devices allows an attacker who can influence a stored, externally supplied value to execute script in the browser of another user who later views the page rendering that value. The flaw affects the Cynap Videobar (before 1.72e), the Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini and Cynap Pure Pro family (before 1.78a), and Cynap Pure (Next Gen) and Cynap Bridge (before 2.00d), with Cynap, Cynap Core and Cynap Pure SDM also listed by the EUVD record. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) the attacker needs some level of authenticated access to write the value and the victim must be induced to load the affected page, so this is stored XSS rather than unauthenticated remote code execution; no public exploit has been identified at time of analysis and EPSS is low at 0.25% (17th percentile).
Unauthenticated information exposure in WOLFVISON Cynap collaboration and presentation devices allows anyone who can reach the web interface to retrieve resources that should only be reachable locally on the device, including screen-saver content and web-interface assets. The flaw stems from a broken access-control check for remote requests and affects Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro before 1.78a, Cynap Videobar before 1.72e, and Cynap Pure (Next Gen) and Cynap Bridge before 2.00d, with the Cynap/Cynap Core/Cynap Pure SDM line listed as affected without a fixed version in the available sources. Per the vendor the exposed resources carry no credentials and no administrative capability, EPSS is low at 0.26% (17th percentile), and no public exploit or active exploitation is indicated, so priority is rated this_month rather than urgent.
Connection-capacity exhaustion in the MICE (Miracast over Infrastructure Connection Establishment) service on WolfVision Cynap collaboration devices lets an unauthenticated remote attacker with network reachability to that service occupy its available connection slots, so legitimate users cannot establish MICE-based Miracast sessions while the condition persists. Exposure is bounded: MICE is disabled in the default configuration and must be explicitly enabled by the customer, and Miracast P2P is unaffected and remains available independently of MICE on most devices, although a complete Miracast disruption can occur on some units when WLAN is configured for Infrastructure mode. EPSS is 0.31% (23rd percentile), no public exploit has been identified at time of analysis, and vendor patches are available for the version branches that list fixed releases.