All vulnerabilities
CVE-2026-70381

Unauthorized Access to Internal Web Resources

WolfVision Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in1.78aAlso 2.00d, 1.72eCVE List
Published26 Oct 2026Updated 26 Oct 2026CVE List

What fixes it

  • 1.78aCynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure ProCVE List
  • 2.00dCynap Pure (Next Gen), Cynap BridgeCVE List
  • 1.72eCynap VideobarCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be accessed remotely by an unauthenticated attacker with network access to the web interface. The accessible resources do not expose credentials or provide administrative functionality, but may include non-public device content, such as screen-saver content or assets used by the web interface.

Text from CVE List

Affected versions 4

  • Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Proaffected: all versions before 1.78aCVE List
  • Cynap Pure (Next Gen), Cynap Bridgeaffected: all versions before 2.00dCVE List
  • Cynap Videobaraffected: all versions before 1.72eCVE List
  • Cynap, Cynap Core, Cynap Pure SDMaffected: version unspecifiedCVE List

References 1