CVE-2026-59106: Unauthenticated RCE Vulnerability in WolfProt interface implementation

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-26 · updated 2026-10-26
Weakness: CWE-78

Description

A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker with network access to a vulnerable service to execute operating-system commands with the privileges of the affected application service.

Summary

CVE-2026-59106 is a critical (CVSS 9.8) unauthenticated remote code execution flaw in the WolfProt interface implementation, caused by insufficient neutralization of user-controlled input. An attacker with network access to a vulnerable service can execute operating-system commands with the privileges of the affected application service. Affected products include WolfVision Cynap, Cynap Core, Cynap Pure SDM, Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini and Cynap Pure Pro (fixed in 1.78a), Cynap Pure (Next Gen) and Cynap Bridge (fixed in 2.00c), and Cynap Videobar firmware (fixed in 1.72e). It is not in CISA KEV and no exploitation has been reported; apply the listed fixed versions or restrict network access to the WolfProt interface as a mitigation.

تتمثل الثغرة CVE-2026-59106 في تنفيذ أوامر عن بُعد دون مصادقة في تطبيق واجهة WolfProt، بسبب عدم كفاية تحييد المدخلات التي يتحكم بها المستخدم. ويستطيع مهاجم لديه وصول إلى الشبكة إلى خدمة مصابة تنفيذ أوامر نظام التشغيل بصلاحيات خدمة التطبيق المتأثرة، ما يجعل الخطورة بالغة (CVSS 9.8). تشمل المنتجات المتأثرة WolfVision Cynap وCynap Core وCynap Pure SDM وCynap Pro وCynap Core Pro وCynap Receiver وCynap Pure وCynap Pure Mini وCynap Pure Pro (تم الإصلاح في 1.78a)، وCynap Pure (Next Gen) وCynap Bridge (تم الإصلاح في 2.00c)، وCynap Videobar Firmware (تم الإصلاح في 1.72e). الثغرة ليست في CISA KEV ولم يُبلَّغ عن استغلالها؛ يُنصح بتثبيت الإصدارات المُصلحة المذكورة أو تقييد الوصول الشبكي إلى واجهة WolfProt كإجراء تخفيفي.

Affected products

WolfVision Cynap, Cynap Core, Cynap Pure SDM: 0
WolfVision Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro: before 1.78a — fixed in 1.78a
WolfVision Cynap Pure (Next Gen), Cynap Bridge: before 2.00c — fixed in 2.00c
WolfVision Cynap Videobar, Firmware Version: before 1.72e — fixed in 1.72e

How to fix

Upgrade to a fixed version: WolfVision Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro 1.78a; WolfVision Cynap Pure (Next Gen), Cynap Bridge 2.00c; WolfVision Cynap Videobar, Firmware Version 1.72e. Check the vendor advisory for mitigations.

References

https://wolfvision.com/de/security/cve-2026-59106-2

Get alerted when CVE-2026-59106 or the next vulnerability affects your stack