Unauthorized Access to Internal Web Resources
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.78a, 2.00d, 1.72e
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The affected software is the web server component of the device's web interface, which fails to restrict certain on-device-only resources. An unauthenticated attacker with network access to that interface could view non-public content, such as screen-saver assets or web interface files, though credentials and administrative functions are not exposed.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be accessed remotely by an unauthenticated attacker with network access to the web interface. The accessible resources do not expose credentials or provide administrative functionality, but may include non-public device content, such as screen-saver content or assets used by the web interface.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- WolfVision Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro
fixed in 1.78a
- WolfVision Cynap Pure (Next Gen), Cynap Bridge
fixed in 2.00d
- WolfVision Cynap Videobar
fixed in 1.72e
- WolfVision Cynap, Cynap Core, Cynap Pure SDM
0