Read the docs
TI-2026-80353 Aliases CVE-2026-59107GHSA-x267-47cw-28j3

Shared SSH key in WolfVision vSolution Matrix file sharing

Priority MEDIUM 48CWE-797Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

WolfVision Cynap Pro and Cynap Core Pro before 1.78a, and Cynap and Cynap Core, are affected. A shared cryptographic trust configuration in the vSolution Matrix file sharing feature lets an attacker who obtains the matching private key log in over SSH as root. The attack needs no privileges or user interaction over the network, and it affects only devices set up as a vSolution Matrix main or master station with file sharing enabled.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

A security vulnerability has been identified in the vSolution Matrix file sharing feature. A shared cryptographic trust configuration could allow an attacker who obtains the matching private key to authenticate to an affected device via SSH as root. This vulnerability affects only devices configured as a vSolution Matrix main/master station with the file sharing feature enabled.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00358 29th percentileScored 2026-11-07
Fix Fixed Cynap Pro, Cynap Core Pro (WolfVision): 1.78a

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WolfVisionCynap Pro, Cynap Core Probefore 1.78a1.78aPatch availableCNA
WolfVisionCynap, Cynap Coreall versions—No fix listedCNA
  • Cynap Pro, Cynap Core Pro VendorWolfVision Affected before 1.78a Fixed in 1.78a Patch available CNA
  • Cynap, Cynap Core VendorWolfVision Affected all versions Fixed in — No fix listed CNA

Remediation

Update Cynap Pro and Cynap Core Pro to version 1.78a. The sources list no fixed version for Cynap, Cynap Core.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA Cynap Pro, Cynap Core Pro (WolfVision) Fixed in 1.78a

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    WolfVision Cynap Pro, Cynap Core Pro 1.78a

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-80533 WolfVision Cynap Unauthorized Access to vSolution Matrix RTSP StreamPriority LOW 30
    Show all 2 records →

Timeline

  1. 2026-10-26 Threatist record created from CVE-2026-59107
  2. 2026-10-27 Alias added: GHSA-x267-47cw-28j3
  3. 2026-11-02 CISA SSVC decision points changed

References

Advisory 1

  • TI-2026-80352 OS command injection in WolfVision WolfProt interface CVSS 4.0CRITICAL 9.3
  • TI-2019-10032 WolfVision Cynap before 1.30j uses a static, hard-coded cryptographic secret for… CVSS 3.0CRITICAL 9.8
  • TI-2026-80580 Web server exposes internal resources in WolfVision Cynap devices CVSS 4.0MEDIUM 6.9
  • TI-2026-80569 Resource exhaustion in WolfVision Cynap MICE service CVSS 4.0MEDIUM 6.9
  • TI-2026-80533 WolfVision Cynap Unauthorized Access to vSolution Matrix RTSP Stream CVSS 4.0HIGH 7.1
  • TI-2026-80581 Stored cross-site scripting in WolfVision Cynap web interface CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences