Shared SSH Authentication Key in vSolution Matrix File Sharing
Peripheral Devices
NTCF:
CVE-2026-59107
CVE:
CVE-2026-59107
Product:
Cynap Pro, Cynap Core Pro, Cynap, Cynap Core
Vendor:
WolfVision
Criticality:
high
Status:
fixed
Discovered:
2026-07-28
Detail:
Public
Vulnerable version:
Cynap Pro, Cynap Core Pro: Firmware Version < v1.78a, Cynap, Cynap Core: all firmware versions
Fixed version:
Cynap Pro, Cynap Core Pro: v1.78a
Summary
A critical security vulnerability has been identified in the vSolution Matrix file sharing feature of WolfVision Cynap products. A shared cryptographic trust configuration could allow an attacker who obtains the matching private key to authenticate to an affected device via SSH as root and achieve arbitrary command execution.
This vulnerability affects only devices configured as a vSolution Matrix main/master station with the file sharing feature enabled.
Remediation
Affected devices should be updated to the following firmware versions as soon as possible:
- Cynap Pro, Cynap Core Pro: firmware version v1.78a
These models are affected and will receive no firmware fix:
-
Cynap
-
Cynap Core
No firmware fix is planned for these discontinued models. Decommission them when feasible, or restrict access to the affected services to trusted hosts and networks.
Timeline
2026-07-28: initial discovery
2026-07-30: first contact to vendor
2026-07-30: private disclosure to vendor
2026-10-21: fix by vendor
2026-10-21: public disclosure