Stored Cross-Site Scripting in Web Interface (WolfVision Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.25 % · percentile 17 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- ENISA
- NVD status
- Awaiting Analysis
Description
Some externally supplied values stored by the device may be rendered in the web interface without sufficient output encoding. An attacker who can influence one of these values could cause script execution in the browser of a user who views an affected page. Exploitation requires an attacker to influence a stored value and a user to view a page that renders it.
Weaknesses (CWE)
- CWE-79 — Improper Neutralization of Input During Web Page Generation
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 4.0 | MEDIUM 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N | ENISA |
| CVSS 3.1 | MEDIUM 4.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L | ENISA |
| CVSS 4.0 | MEDIUM 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · a6d3dc9e-0591-4a13-bce7-0f5b31ff6158 (Secondary) |
| CVSS 3.1 | MEDIUM 4.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L | NVD · a6d3dc9e-0591-4a13-bce7-0f5b31ff6158 (Secondary) |
European references
- ENISA EUVD · EUVD-2026-110312
- GCVE · GCVE-0-2026-70382
Affected products
| Product | Versions |
|---|---|
| WolfVision · Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro | affected 0 < 1.78a |
| WolfVision · Cynap Pure (Next Gen), Cynap Bridge | affected 0 < 2.00d |
| WolfVision · Cynap Videobar | affected 0 < 1.72e |
| WolfVision · Cynap, Cynap Core, Cynap Pure SDM | affected 0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |