Wolfvision
Monthly
Unauthenticated screen-content disclosure in WolfVision Cynap Pro and Cynap Core Pro devices with vSolution Matrix enabled lets hosts on the same network segment view or capture the current presentation through an unencrypted RTSP/RTP stream. The issue affects versions below 1.78a and is limited to confidentiality; the vendor has released 1.78a, and no public exploit was identified at time of analysis. Exposure is bounded by the non-default Matrix feature requirement and network adjacency.
Unauthenticated OS command injection in the WolfProt interface of WolfVision Cynap collaboration devices allows a remote attacker who can reach the service to run arbitrary operating-system commands at the privilege level of the Cynap application service. The flaw is rated 9.3 (CVSS 4.0: AV:N/AC:L/AT:N/PR:N/UI:N, with high confidentiality, integrity and availability impact) and maps to CWE-78; the vulnerable surface spans the Cynap, Cynap Core, Cynap Core Pro, Cynap Pro, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro, Cynap Pure Next Gen, Cynap Pure SDM, Cynap Receiver, Cynap Bridge and Cynap Videobar firmware lines. Per the supplied intelligence the decision is act_now; no public exploit code and no confirmed active exploitation were reported in the available data. The practical exposure gate is network reachability of the WolfProt service, so devices reachable from management or meeting-room networks carry the most risk.
Unauthenticated screen-content disclosure in WolfVision Cynap Pro and Cynap Core Pro devices with vSolution Matrix enabled lets hosts on the same network segment view or capture the current presentation through an unencrypted RTSP/RTP stream. The issue affects versions below 1.78a and is limited to confidentiality; the vendor has released 1.78a, and no public exploit was identified at time of analysis. Exposure is bounded by the non-default Matrix feature requirement and network adjacency.
Unauthenticated OS command injection in the WolfProt interface of WolfVision Cynap collaboration devices allows a remote attacker who can reach the service to run arbitrary operating-system commands at the privilege level of the Cynap application service. The flaw is rated 9.3 (CVSS 4.0: AV:N/AC:L/AT:N/PR:N/UI:N, with high confidentiality, integrity and availability impact) and maps to CWE-78; the vulnerable surface spans the Cynap, Cynap Core, Cynap Core Pro, Cynap Pro, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro, Cynap Pure Next Gen, Cynap Pure SDM, Cynap Receiver, Cynap Bridge and Cynap Videobar firmware lines. Per the supplied intelligence the decision is act_now; no public exploit code and no confirmed active exploitation were reported in the available data. The practical exposure gate is network reachability of the WolfProt service, so devices reachable from management or meeting-room networks carry the most risk.