Read the docs
TI-2026-80581 Aliases CVE-2026-70382GHSA-fpcw-xmfj-qj6q

Stored cross-site scripting in WolfVision Cynap web interface

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

WolfVision Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro, Cynap Pure (Next Gen), Cynap Bridge, Cynap Videobar, Cynap, Cynap Core and Cynap Pure SDM are affected, with the fixed-version ranges given in the solution. Externally supplied values stored by the device are rendered in the web interface without sufficient output encoding (CWE-79). An attacker with low privileges who can influence a stored value can run script in the browser of a user who views an affected page.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Some externally supplied values stored by the device may be rendered in the web interface without sufficient output encoding. An attacker who can influence one of these values could cause script execution in the browser of a user who views an affected page. Exploitation requires an attacker to influence a stored value and a user to view a page that renders it.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00253 16th percentileScored 2026-11-07
Fix Fixed Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro (WolfVision): 1.78aCynap Pure (Next Gen), Cynap Bridge (WolfVision): 2.00d+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WolfVisionCynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Probefore 1.78a1.78aPatch availableCNA
WolfVisionCynap Pure (Next Gen), Cynap Bridgebefore 2.00d2.00dPatch availableCNA
WolfVisionCynap Videobarbefore 1.72e1.72ePatch availableCNA
WolfVisionCynap, Cynap Core, Cynap Pure SDMall versions—No fix listedCNA
  • Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro VendorWolfVision Affected before 1.78a Fixed in 1.78a Patch available CNA
  • Cynap Pure (Next Gen), Cynap Bridge VendorWolfVision Affected before 2.00d Fixed in 2.00d Patch available CNA
  • Cynap Videobar VendorWolfVision Affected before 1.72e Fixed in 1.72e Patch available CNA
  • Cynap, Cynap Core, Cynap Pure SDM VendorWolfVision Affected all versions Fixed in — No fix listed CNA

Remediation

Update Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini and Cynap Pure Pro to 1.78a, Cynap Pure (Next Gen) and Cynap Bridge to 2.00d, and Cynap Videobar to 1.72e. The sources list no fixed version for Cynap, Cynap Core or Cynap Pure SDM.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro (WolfVision) Fixed in 1.78a
  • Fix · CNA Cynap Pure (Next Gen), Cynap Bridge (WolfVision) Fixed in 2.00d
  • Fix · CNA Cynap Videobar (WolfVision) Fixed in 1.72e

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    WolfVision Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro 1.78a

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-80352 OS command injection in WolfVision WolfProt interfacePriority MEDIUM 49
    • TI-2026-80580 Web server exposes internal resources in WolfVision Cynap devicesPriority LOW 36
    Show all 3 records →
  • Release ·

    WolfVision Cynap Videobar 1.72e

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-80580 Web server exposes internal resources in WolfVision Cynap devicesPriority LOW 36
    • TI-2026-80569 Resource exhaustion in WolfVision Cynap MICE servicePriority LOW 36
    Show all 3 records →
Show 1 more group
  • Release ·

    WolfVision Cynap Pure (Next Gen), Cynap Bridge 2.00d

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-80580 Web server exposes internal resources in WolfVision Cynap devicesPriority LOW 36
    Show all 2 records →

Timeline

  1. 2026-10-26 Threatist record created from CVE-2026-70382
  2. 2026-10-27 Alias added: GHSA-fpcw-xmfj-qj6q
  3. 2026-11-02 CISA SSVC decision points changed

References

Advisory 1

  • TI-2026-80352 OS command injection in WolfVision WolfProt interface CVSS 4.0CRITICAL 9.3
  • TI-2026-80353 Shared SSH key in WolfVision vSolution Matrix file sharing CVSS 4.0CRITICAL 9.2
  • TI-2019-10032 WolfVision Cynap before 1.30j uses a static, hard-coded cryptographic secret for… CVSS 3.0CRITICAL 9.8
  • TI-2026-80580 Web server exposes internal resources in WolfVision Cynap devices CVSS 4.0MEDIUM 6.9
  • TI-2026-80569 Resource exhaustion in WolfVision Cynap MICE service CVSS 4.0MEDIUM 6.9
  • TI-2026-80533 WolfVision Cynap Unauthorized Access to vSolution Matrix RTSP Stream CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences