{"id":"CVE-2026-59106","title":"Unauthenticated RCE Vulnerability in WolfProt interface implementation","summary":"A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker with network access to a vulnerable service to execute op…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-78"],"vendor":"WolfVision","product":"Cynap Pure (Next Gen), Cynap Bridge","affected":["cynap_pure_next_gen_cynap_bridge < 2.00c","cynap_pro_cynap_core_pro_cynap_receiver_cynap_pure_cynap_pure_mini_cynap_pure_pro < 1.78a","cynap_videobar_firmware_version < 1.72e","cynap_cynap_core_cynap_pure_sdm all versions"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-26T15:04:38.018668Z"},"published":"2026-10-26","updated":"2026-10-26","sourceUpdated":"2026-10-26T15:35:52.374Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-59106","references":[{"url":"https://wolfvision.com/de/security/cve-2026-59106-2"}],"tags":["cve.org"],"ingestedAt":"2026-10-26T14:27:31.827Z","slug":"CVE-2026-59106","body":"## Overview\n\nA security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker with network access to a vulnerable service to execute operating-system commands with the privileges of the affected application service.\n\n## Affected\n\n- `cynap_pure_next_gen_cynap_bridge < 2.00c`\n- `cynap_pro_cynap_core_pro_cynap_receiver_cynap_pure_cynap_pure_mini_cynap_pure_pro < 1.78a`\n- `cynap_videobar_firmware_version < 1.72e`\n- `cynap_cynap_core_cynap_pure_sdm all versions`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nUntil an update can be applied, restrict network access to the \nWolfProt-related ports (TCP 50915 and 50917) as well as the web \nmanagement interfaces (TCP 80 and 443) to trusted hosts only. Note that \nthese services cannot be disabled. WolfVision recommends keeping devices up to date and using \ndedicated, managed network segments (VLAN or firewall zone) to restrict \ndevice access to trusted hosts only.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}