Stored Cross-Site Scripting in Web Interface of WolfVision Cynap Products

Peripheral Devices

NTCF:
CVE-2026-70382

CVE:
CVE-2026-70382

Product:
Cynap Pure (Next Gen), Cynap Bridge, Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro, Cynap Videobar, Cynap, Cynap Core, Cynap Pure SDM

Vendor:
WolfVision

Criticality:
medium

Status:
fixed

Discovered:
2026-07-28

Detail:
Public

Vulnerable version:
Cynap Pure (Next Gen), Cynap Bridge: Firmware Version < v2.00d Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro: Firmware Version < v1.78a Cynap Videobar, Firmware Version < v1.72e Cynap, Cynap Core, Cynap Pure SDM: all firmware versions

Fixed version:
Cynap Pure (Next Gen), Cynap Bridge: Firmware Version v2.00d Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro: Firmware Version v1.78a Cynap Videobar, Firmware Version v1.72e

Summary

Some externally supplied values stored by the device may be rendered in the web interface without sufficient output encoding. An attacker who can influence one of these values could cause script execution in the browser of a user who views an affected page.

Exploitation requires an attacker to influence a stored value and a user to view a page that renders it.

Remediation

Affected devices should be updated to the following firmware versions as soon as possible:

Cynap Pure (Next Gen), Cynap Bridge: firmware version v2.00d
Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro: firmware version v1.78a
Cynap Videobar: firmware version v1.72e

These models are affected and will receive no firmware fix:

Cynap
Cynap Core
Cynap Pure SDM

No firmware fix is planned for these discontinued models. Decommission them when feasible, or restrict access to the affected services to trusted hosts and networks.

Stored Cross-Site Scripting in Web Interface of WolfVision Cynap Products

Summary

Remediation

Acknowledgements

References

Timeline