Cynap Pro Cynap Core Pro
Monthly
Unauthenticated screen-content disclosure in WolfVision Cynap Pro and Cynap Core Pro devices with vSolution Matrix enabled lets hosts on the same network segment view or capture the current presentation through an unencrypted RTSP/RTP stream. The issue affects versions below 1.78a and is limited to confidentiality; the vendor has released 1.78a, and no public exploit was identified at time of analysis. Exposure is bounded by the non-default Matrix feature requirement and network adjacency.
Root-level SSH access to WolfVision vSolution Matrix appliances can be obtained by anyone holding the private key that matches the product's shared cryptographic trust configuration, allowing authentication as root on affected devices. Only devices configured as a vSolution Matrix main/master station with the file sharing feature enabled are in scope, so the exposed population is a non-default subset rather than every deployment; the CVSS 4.0 vector (9.2) marks PR:N and UI:N, meaning no legitimate credentials or victim interaction are required once the key is in hand, while AT:P reflects that the key must first be acquired. No public exploit code or confirmed active exploitation appears in the supplied intelligence, but the vuln.today decision label is act_now and the shared nature of the trust material means one recovered key can potentially be replayed against multiple affected master stations.
Unauthenticated screen-content disclosure in WolfVision Cynap Pro and Cynap Core Pro devices with vSolution Matrix enabled lets hosts on the same network segment view or capture the current presentation through an unencrypted RTSP/RTP stream. The issue affects versions below 1.78a and is limited to confidentiality; the vendor has released 1.78a, and no public exploit was identified at time of analysis. Exposure is bounded by the non-default Matrix feature requirement and network adjacency.
Root-level SSH access to WolfVision vSolution Matrix appliances can be obtained by anyone holding the private key that matches the product's shared cryptographic trust configuration, allowing authentication as root on affected devices. Only devices configured as a vSolution Matrix main/master station with the file sharing feature enabled are in scope, so the exposed population is a non-default subset rather than every deployment; the CVSS 4.0 vector (9.2) marks PR:N and UI:N, meaning no legitimate credentials or victim interaction are required once the key is in hand, while AT:P reflects that the key must first be acquired. No public exploit code or confirmed active exploitation appears in the supplied intelligence, but the vuln.today decision label is act_now and the shared nature of the trust material means one recovered key can potentially be replayed against multiple affected master stations.