What’s Vulnerable › Vulnerabilities
CVE-2026-70382: Stored Cross-Site Scripting in Web Interface
- Severity: medium (CVSS 4.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-26 · updated 2026-10-27
- Weakness: CWE-79
Description
Some externally supplied values stored by the device may be rendered in the web interface without sufficient output encoding. An attacker who can influence one of these values could cause script execution in the browser of a user who views an affected page. Exploitation requires an attacker to influence a stored value and a user to view a page that renders it.
Affected products
- WolfVision Cynap, Cynap Core, Cynap Pure SDM: 0
- WolfVision Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro: before 1.78a — fixed in 1.78a
- WolfVision Cynap Pure (Next Gen), Cynap Bridge: before 2.00d — fixed in 2.00d
- WolfVision Cynap Videobar: before 1.72e — fixed in 1.72e
How to fix
Upgrade to a fixed version: WolfVision Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro 1.78a; WolfVision Cynap Pure (Next Gen), Cynap Bridge 2.00d; WolfVision Cynap Videobar 1.72e. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-70382 or the next vulnerability affects your stack