Technical impact
A wolfProt interface implementation flaw allows an unauthenticated network attacker to execute arbitrary operating‑system commands with the privileges of the affected service due to insufficient neutralization of user‑controlled input. The vulnerability is a typical OS command injection (CWE‑78) and can provide full system compromise if exploited on the targeted edge devices.
Affected Systems
The vulnerability affects a range of WolfVision Cynap edge devices, including Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro, WolfVision Cynap Pure (Next Gen), Cynap Bridge, WolfVision Cynap Videobar, firmware versions for WolfVision Cynap, Cynap Core, and Cynap Pure SDM. No specific version numbers are disclosed in the advisory.
Risk and Exploitability
The CVSS score of 9.3 indicates critical severity, and the vulnerability is not yet listed in the CISA KEV catalog. EPSS is not available, so current exploitation probability is unclear, but the unauthenticated, network‑based nature and lack of privilege escalation checks suggest it can be exploited by remote actors with direct network access to the WolfProt ports 50915 and 50917, as well as HTTP/HTTPS management interfaces. Because the affected service cannot be disabled, the only mitigation until a patch is applied is to restrict network reachability to trusted hosts.
