Weenygenius
Monthly
Origin validation failure in WeenyGenius, Howyar Technologies' computer lab management system, allows any unauthenticated attacker adjacent to the school network to impersonate the teacher workstation by sending spoofed broadcast packets. Student machines running the WeenyGenius client accept these packets without verifying their source, causing them to initiate management connections to the attacker's host. No public exploit has been identified at time of analysis, but the zero-complexity adjacent-network attack makes exploitation trivially feasible by any insider - including students - on the same LAN.
WeenyGenius computer lab management software by Howyar Technologies transmits control commands over ZMTP Null mode - ZeroMQ's no-authentication, no-encryption transport - leaving all management traffic exposed on the local network. Unauthenticated adjacent-network attackers can passively capture plaintext session data or actively replay forged classroom commands to disrupt exams and lesson control. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the attack requires only standard network tooling and network adjacency.
WeenyGenius, a computer lab management system by Howyar Technologies, exposes its endpoint communication protocol without any authentication, allowing any adjacent-network attacker to impersonate either student or teacher roles. The teacher-impersonation path is the critical vector: posing as a teacher causes student workstations to initiate management connections back to the attacker, yielding remote control over every student endpoint in the lab. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the zero-privilege, zero-interaction requirement within a reachable network makes exploitation straightforward for any insider or network-adjacent threat actor.
Replay attack vulnerability in WeenyGenius, a computer lab management system by Howyar Technologies, allows unauthenticated adjacent-network attackers to forge student attendance status. By intercepting a legitimate student connection packet and replaying it, an attacker can make the management system believe the student remains connected after they have disconnected. No public exploit has been identified at time of analysis, and EPSS data is not available for this entry.
Origin validation failure in WeenyGenius, Howyar Technologies' computer lab management system, allows any unauthenticated attacker adjacent to the school network to impersonate the teacher workstation by sending spoofed broadcast packets. Student machines running the WeenyGenius client accept these packets without verifying their source, causing them to initiate management connections to the attacker's host. No public exploit has been identified at time of analysis, but the zero-complexity adjacent-network attack makes exploitation trivially feasible by any insider - including students - on the same LAN.
WeenyGenius computer lab management software by Howyar Technologies transmits control commands over ZMTP Null mode - ZeroMQ's no-authentication, no-encryption transport - leaving all management traffic exposed on the local network. Unauthenticated adjacent-network attackers can passively capture plaintext session data or actively replay forged classroom commands to disrupt exams and lesson control. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the attack requires only standard network tooling and network adjacency.
WeenyGenius, a computer lab management system by Howyar Technologies, exposes its endpoint communication protocol without any authentication, allowing any adjacent-network attacker to impersonate either student or teacher roles. The teacher-impersonation path is the critical vector: posing as a teacher causes student workstations to initiate management connections back to the attacker, yielding remote control over every student endpoint in the lab. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the zero-privilege, zero-interaction requirement within a reachable network makes exploitation straightforward for any insider or network-adjacent threat actor.
Replay attack vulnerability in WeenyGenius, a computer lab management system by Howyar Technologies, allows unauthenticated adjacent-network attackers to forge student attendance status. By intercepting a legitimate student connection packet and replaying it, an attacker can make the management system believe the student remains connected after they have disconnected. No public exploit has been identified at time of analysis, and EPSS data is not available for this entry.