Vulnerability · Published Oct 26, 2026 · Assigned by ENISA

CVE-2026-70381Unauthorized Access to Internal Web Resources

Medium 5.3

In plain English

A medium-severity authentication bypass by spoofing in Cynap, Cynap Core, Cynap Pure SDM from WolfVision. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 82.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be accessed remotely by an unauthenticated attacker with network access to the web interface. The accessible resources do not expose credentials or provide administrative functionality, but may include non-public device content, such as screen-saver content or assets used by the web interface.

Affected products (as reported)

Vendor	Product	Versions
WolfVision	Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro	0 – before 1.78a
WolfVision	Cynap Pure (Next Gen), Cynap Bridge	0 – before 2.00d
WolfVision	Cynap Videobar	0 – before 1.72e
WolfVision	Cynap, Cynap Core, Cynap Pure SDM	0

Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://wolfvision.com/de/security/cve-2026-70381-1 vendor-advisory