Unauthorized Access to Internal Web Resources on WolfVision Cynap Products
Peripheral Devices
NTCF:
CVE-2026-70381
CVE:
CVE-2026-70381
Product:
Cynap Pure (Next Gen), Cynap Bridge, Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro, Cynap Videobar, Cynap, Cynap Core, Cynap Pure SDM
Vendor:
WolfVision
Criticality:
medium
Status:
fixed
Discovered:
2026-07-28
Detail:
Public
Vulnerable version:
Cynap Pure (Next Gen), Cynap Bridge: Firmware Version < v2.00d Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro: Firmware Version < v1.78a Cynap Videobar, Firmware Version < v1.72e Cynap, Cynap Core, Cynap Pure SDM: all firmware versions
Fixed version:
Cynap Pure (Next Gen), Cynap Bridge: Firmware Version v2.00d Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro: Firmware Version v1.78a Cynap Videobar, Firmware Version v1.72e
Summary
An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be accessed remotely by an unauthenticated attacker with network access to the web interface.
The accessible resources do not expose credentials or provide administrative functionality, but may include non-public device content, such as screen-saver content or assets used by the web interface.
Remediation
Affected devices should be updated to the following firmware versions as soon as possible:
-
Cynap Pure (Next Gen), Cynap Bridge: firmware version v2.00d
- Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro: firmware version v1.78a
- Cynap Videobar: firmware version v1.72e
These models are affected and will receive no firmware fix:
-
Cynap
-
Cynap Core
- Cynap Pure SDM
No firmware fix is planned for these discontinued models. Decommission them when feasible, or restrict access to the affected services to trusted hosts and networks.
Timeline
2026-07-28: initial discovery
2026-07-30: first contact to vendor
2026-07-30: private disclosure to vendor
2026-10-21: fix by vendor
2026-10-21: public disclosure