{"id":"CVE-2026-89178","state":"PUBLISHED","title":"Howyar｜WeenyGenius - Origin Validation Error","description":"WeenyGenius, a computer lab management system by Howyar Technologies, has an Origin Validation Error vulnerability. Unauthenticated attackers on the same network can spoof the teacher workstation and send broadcast packets, causing student computers to attempt to establish a connection with the attacker.","publishedAt":"2026-09-11T07:36:25.977Z","updatedAt":"2026-09-11T15:31:20.920Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"twcert"},"assigner":"twcert","products":["Howyar WeenyGenius"],"affected":[{"vendor":"Howyar","product":"WeenyGenius","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"12.2.031","versionType":"custom"}]}],"references":["https://www.twcert.org.tw/tw/cp-132-11201-658c0-1.html","https://www.twcert.org.tw/en/cp-139-11200-ffc3c-2.html"],"weaknesses":["CWE-940"],"ingestedAt":"2026-10-29T20:13:26.108Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/89xxx/CVE-2026-89178.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-89178","state":"PUBLISHED","datePublished":"2026-09-11T07:36:25.977Z","dateUpdated":"2026-09-11T15:31:20.920Z","assignerShortName":"twcert","assignerOrgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","dateReserved":"2026-09-11T06:14:51.177Z"},"containers":{"cna":{"title":"Howyar｜WeenyGenius - Origin Validation Error","descriptions":[{"lang":"en","value":"WeenyGenius, a computer lab management system by Howyar Technologies, has an Origin Validation Error vulnerability. Unauthenticated attackers on the same network can spoof the teacher workstation and send broadcast packets, causing student computers to attempt to establish a connection with the attacker."}],"affected":[{"vendor":"Howyar","product":"WeenyGenius","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"12.2.031","versionType":"custom"}]}],"references":[{"url":"https://www.twcert.org.tw/tw/cp-132-11201-658c0-1.html","tags":["third-party-advisory"]},{"url":"https://www.twcert.org.tw/en/cp-139-11200-ffc3c-2.html","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"HIGH","baseScore":8.7,"vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"HIGH","baseScore":8.8,"vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-940","lang":"en","description":"CWE-940 Improper Verification of Source of a Communication Channel","type":"CWE"}]}],"providerMetadata":{"shortName":"twcert","orgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","dateUpdated":"2026-09-11T07:36:25.977Z"},"datePublic":"2026-09-11T07:36:00.000Z","solutions":[{"lang":"en","value":"Update to version 12.3.033 or later.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>Update to version 12.3.033 or later.</p>"}]}],"source":{"advisory":"TVN-202609005","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-11T15:30:40.855860Z","id":"CVE-2026-89178","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-11T15:31:20.920Z"}}]}}}