CVE-2026-89177

Howyar｜WeenyGenius - Use of Insecure Protocol

Published Sep 11, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

WeenyGenius, a computer lab management system by Howyar Technologies, has a Use of Insecure Protocol vulnerability. Due to the reliance on ZMTP Null mode, unauthenticated attackers on the same network can capture packets to leak transmitted data, or perform replay attacks with forged commands to disrupt classroom operations.

Analysis

Technical impact

WeenyGenius relies on ZMTP Null mode, an insecure protocol that does not provide encryption or integrity protection. Because of this, anyone on the same network can intercept packets to expose information or replay forged commands, potentially causing disruptions to lesson plans and data leakage.

Affected Systems

The vulnerability affects all Howyar WeenyGenius installations before version 12.3.033. The vendor recommends updating to version 12.3.033 or later to remove the insecure protocol support.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity flaw. The EPSS score is not available, but the flaw allows unauthenticated, local network attackers to exploit the system. It is not listed in CISA KEV, yet the lack of authentication combined with local network access makes exploitation likely if an attacker gains proximity.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Howyar

WeenyGenius

unaffected

Version	Status	Constraints
`0`	affected	≤ 12.2.031

No data.

Vendor Product Versions

Howyar

Weenygenius

Version	Status	Scheme	Platform
`[0,12.2.031]`	affected	semver	—

Remediation

Vendor Solution

Update to version 12.3.033 or later.

OpenCVE Recommended Actions

Upgrade WeenyGenius to version 12.3.033 or later to eliminate the insecure ZMTP Null mode.
If an immediate upgrade is not possible, block ZMTP Null mode traffic using firewall or ACL rules to prevent packet sniffing and replay attacks.
Segment the lab network and restrict access to the WeenyGenius server to authorized personnel only to limit exposure to unauthenticated local attackers.

Generated by OpenCVE AI on September 11, 2026 at 08:21 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.356% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.twcert.org.tw/en/cp-139-11200-ffc3c-2.html
https://www.twcert.org.tw/tw/cp-132-11201-658c0-1.html

History

Sep 13, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Howyar Howyar weenygenius
Vendors & Products		Howyar Howyar weenygenius

Sep 11, 2026 11:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 11, 2026 7:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		WeenyGenius, a computer lab management system by Howyar Technologies, has a Use of Insecure Protocol vulnerability. Due to the reliance on ZMTP Null mode, unauthenticated attackers on the same network can capture packets to leak transmitted data, or perform replay attacks with forged commands to disrupt classroom operations.
Title		Howyar｜WeenyGenius - Use of Insecure Protocol
Weaknesses		CWE-757
References		https://www.twcert.org.tw/en/cp-139-11200-ffc3c-2.html https://www.twcert.org.tw/tw/cp-132-11201-658c0-1.html
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`