CVE-2026-70382: WolfVision Cynap stored cross-site scripting in web interface

CVE-2026-70382 · Severity: medium · CVSS 4.1 · Published 2026-10-26

WolfVision Cynap devices are collaboration and presentation systems used in conference rooms and shared workspaces. A stored cross-site scripting vulnerability in the web interface allows an authenticated attacker to inject malicious scripts that execute in the browsers of users viewing affected pages, potentially leading to session hijacking, credential theft, or malware distribution. Exploitation requires the attacker to first inject a payload into the device and have a user view the affected page.

Technologies: WolfVision Cynap Bridge, WolfVision Cynap Core Pro, WolfVision Cynap Pro, WolfVision Cynap Pure, WolfVision Cynap Pure (Next Gen), WolfVision Cynap Pure Mini, WolfVision Cynap Pure Pro, WolfVision Cynap Receiver, WolfVision Cynap Videobar. Vendors: WolfVision.

Quick answers

Is CVE-2026-70382 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-70382 being exploited in the wild.
How severe is CVE-2026-70382?
Medium severity, with a CVSS score of 4.1, published 26 October 2026.
Which products and versions are affected?
WolfVision Cynap Bridge before v2.00d; WolfVision Cynap Core Pro before v1.78a; WolfVision Cynap Pro before v1.78a; WolfVision Cynap Pure before v1.78a; and 5 more.
Is there a fix for CVE-2026-70382?
Yes: fixed in Cynap Pure (Next Gen), Cynap Bridge: v2.00d; Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro: v1.78a; Cynap Videobar: v1.72e. Until then: Restrict access to web management interfaces on TCP ports 80 and 443 to trusted hosts only using firewall rules or network segmentation. Avoid opening or displaying content from untrusted sources on the device until it is updated. For discontinued models (Cynap, Cynap Core, Cynap Pure SDM), decommission them when feasible or restrict access to dedicated, managed network segments.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-09-21" }, { "kind": "advisory", "at": "2026-10-26" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-70382 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-70382?
Check whether you run WolfVision Cynap Bridge, WolfVision Cynap Core Pro, WolfVision Cynap Pro or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Cynap Pure (Next Gen), Cynap Bridge: v2.00d; Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro: v1.78a; Cynap Videobar: v1.72e

Restrict access to web management interfaces on TCP ports 80 and 443 to trusted hosts only using firewall rules or network segmentation. Avoid opening or displaying content from untrusted sources on the device until it is updated. For discontinued models (Cynap, Cynap Core, Cynap Pure SDM), decommission them when feasible or restrict access to dedicated, managed network segments.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-09-21" }, { "kind": "advisory", "at": "2026-10-26" } ]

Technical details

This is a stored cross-site scripting (XSS) vulnerability caused by insufficient output encoding of externally supplied values rendered in the web interface (CWE-79). An authenticated attacker can inject malicious scripts that persist on the device; when any user views a page containing the rendered value, the script executes in their browser context with the user's privileges. Exploitation requires network access and authentication, plus user interaction to view an affected page.

Affected products

  • WolfVision Cynap Pure (Next Gen) before v2.00d
  • WolfVision Cynap Bridge before v2.00d
  • WolfVision Cynap Pro before v1.78a
  • WolfVision Cynap Core Pro before v1.78a
  • WolfVision Cynap Receiver before v1.78a
  • WolfVision Cynap Pure before v1.78a
  • WolfVision Cynap Pure Mini before v1.78a
  • WolfVision Cynap Pure Pro before v1.78a
  • WolfVision Cynap Videobar before v1.72e

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.