Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-70381— Unauthorized Access to Internal Web Resources

Quick assessment

Affected
WolfVision Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

已在 Web 服务器配置中发现一个访问控制漏洞。原本仅限设备本地访问的某些资源，可能被拥有网络访问权限且未通过身份验证的攻击者通过 Web 接口远程访问。 这些可访问的资源不会泄露凭据，也不提供管理功能，但可能包含非公开的设备内容，例如屏保内容或 Web 界面所使用的资源文件。

CVSS 5.3 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-70381

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Unauthorized Access to Internal Web Resources
Source: CVE Program / CVE List V5
Vulnerability Description
An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be accessed remotely by an unauthenticated attacker with network access to the web interface. The accessible resources do not expose credentials or provide administrative functionality, but may include non-public device content, such as screen-saver content or assets used by the web interface.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用欺骗进行的认证绕过
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
WolfVision Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro 0 ~ 1.78a -
WolfVision Cynap Pure (Next Gen), Cynap Bridge 0 ~ 2.00d -
WolfVision Cynap Videobar 0 ~ 1.72e -
WolfVision Cynap, Cynap Core, Cynap Pure SDM 0 -

II. Public POCs for CVE-2026-70381

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-70381

请登录查看更多情报信息。

Other References for CVE-2026-70381 (1)

Same Patch Batch · WolfVision · 2026-10-26 · 6 CVEs total

CVE-2026-59107 9.8 CRITICAL Shared SSH Authentication Key in vSolution Matrix File Sharing
CVE-2026-59106 9.8 CRITICAL Unauthenticated RCE Vulnerability in WolfProt interface implementation
CVE-2026-70379 6.5 MEDIUM Unauthorized Access to vSolution Matrix RTSP
CVE-2026-70380 5.3 MEDIUM Resource Exhaustion in MICE Service
CVE-2026-70382 4.1 MEDIUM Stored Cross-Site Scripting in Web Interface

IV. Related Vulnerabilities

Same product: Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro
Same vendor: WolfVision
Same weakness: CWE-290