Live › vulnerability › CVE-2026-59106
Go to dashboardThe WolfProt interface implementation does not neutralize user-controlled input, so input can reach operating-system command execution. An unauthenticated attacker with network access to a vulnerable service can run commands with the privileges of that application service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
WolfVision Cynap and Videobar meeting-room/AV devices are exposed if an attacker can reach their WolfProt ports (TCP 50915, 50917) or web interface (TCP 80/443) over the network; no login is needed and commands run as the application service. Teams with these devices on flat or shared office/guest networks should act first. Anyone without WolfVision devices can skip it; devices on isolated VLANs reachable only by trusted hosts have reduced risk but still need the update.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Cynap Pure (Next Gen) / Cynap Bridge firmware | vendor | < 2.00c | 2.00c |
| Cynap Pro / Core Pro / Receiver / Pure / Pure Mini / Pure Pro firmware | vendor | < 1.78a | 1.78a |
| Cynap Videobar firmware | vendor | < 1.72e | 1.72e |
| Cynap / Cynap Core / Cynap Pure SDM | vendor | all versions | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker with network access to a vulnerable service to execute operating-system commands with the privileges of the affected application service.
This page as .md · .json · in your agent: get_signal("CVE-2026-59106")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.