CVE-2026-70382 json
Stored Cross-Site Scripting in Web Interface
published 16d ago modified 9d ago also EUVD-2026-110312
- cvss
- 4.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 16%
- public exploits
- 0
- none known
Summary
Some externally supplied values stored by the device may be rendered in the web interface without sufficient output encoding. An attacker who can influence one of these values could cause script execution in the browser of a user who views an affected page. Exploitation requires an attacker to influence a stored value and a user to view a page that renders it.
Patch / fix
- WolfVision Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro 1.78a
- WolfVision Cynap Pure (Next Gen), Cynap Bridge 2.00d
- WolfVision Cynap Videobar 1.72e
Is CVE-2026-70382 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 9d ago
Exploit prediction
0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
| CNA | 3.1 | 4.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L |
| CNA | 4.0 | 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- WolfVision Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro
- WolfVision Cynap Pure (Next Gen), Cynap Bridge
- WolfVision Cynap Videobar
- WolfVision Cynap, Cynap Core, Cynap Pure SDM
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
wolfvision.com
/de/security/cve-2026-70382-1
vendor-advisory
Sources
- CVE List CVE-2026-70382
- NVD CVE-2026-70382
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.