WolfVision Cynap: OS command injection in WolfProt interface
Summary
WolfVision Cynap devices contain an OS command injection flaw (CWE-78) in the WolfProt control interface, rated critical with CVSS v4.0 9.3. An unauthenticated attacker with network access to the WolfProt ports (TCP 50915, 50917) or the web interfaces (TCP 80, 443) can execute operating-system commands with the privileges of the affected service. Successful exploitation could lead to unauthorised access to data, modification or disruption of device functions, and a foothold on the internal network. Firmware fixes exist for supported models; discontinued models receive no fix.
Affected
- Cynap Pure (Next Gen), Cynap Bridge: firmware below v2.00c
- Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro: firmware below v1.78a
- Cynap Videobar: firmware below v1.72e
- Cynap, Cynap Core, Cynap Pure SDM: all firmware versions (discontinued)
Fixed in
- Cynap Pure (Next Gen), Cynap Bridge: v2.00c
- Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro: v1.78a
- Cynap Videobar: v1.72e
- Cynap, Cynap Core, Cynap Pure SDM: no fix planned
Workaround
- Restrict network access to TCP 50915 and 50917 (WolfProt) and TCP 80 and 443 (web management) to trusted hosts only until the firmware is updated. These services cannot be disabled.
- Use dedicated, managed network segments (VLAN or firewall zone) to restrict device access to trusted hosts.
Exploitation
- The vendor is not aware of active exploitation at the time of publication.
- No public exploit was found, and the CVE is not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
Our recommendation
- Inventory all Cynap devices and their firmware versions.
- Update to the fixed firmware as soon as possible.
- Decommission or isolate discontinued models (Cynap, Cynap Core, Cynap Pure SDM), as no fix is available.
- Verify that ports 50915, 50917, 80 and 443 are not reachable from the internet, guest networks or untrusted VLANs, and check NAT and port-forwarding rules.
- Monitor for unusual connections to these ports and unexpected device behaviour.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WolfVision Security Advisory CVE-2026-59106 (English) wolfvision.com
- WolfVision Sicherheitshinweis CVE-2026-59106 (Deutsch) wolfvision.com
- VulDB CVE-2026-59106 vuldb.com
- OpenCVE CVE-2026-59106 app.opencve.io
- OffSeq Radar CVE-2026-59106 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:42.
Original description (NVD)
A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker with network access to a vulnerable service to execute operating-system commands with the privileges of the affected application service.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.