Forwarded from TWCERTCC Cybersecurity Alert TWCERTCC-200-202609-00000018

Hao Ya Technology's WeenyGenius contains four security vulnerabilities, including three critical cybersecurity vulnerabilities:

【Hao Ya Technology｜WeenyGenius - Missing Authentication】(CVE-2026-89176, CVSS: 8.8) An unauthenticated attacker on the same network can easily impersonate a student or teacher computer. If a student computer is impersonated, normal classroom use by the student may be affected; if a teacher computer is impersonated, the attacker may control student computers.

【Hao Ya Technology｜WeenyGenius - Use of Insecure Protocol】(CVE-2026-89177, CVSS: 8.8) Because the communication protocol uses ZMTP Null mode, an unauthenticated attacker on the same network may capture and monitor packets to obtain transmitted content.

【Hao Ya Technology｜WeenyGenius - Origin Validation Error】(CVE-2026-89178, CVSS: 8.8) An unauthenticated attacker on the same network may impersonate the teacher side and initiate broadcast packets, causing student computers to attempt to establish connections with the attacker.

【Hao Ya Technology｜WeenyGenius - Missing Support for Integrity Check】(CVE-2026-89179, CVSS: 4.3) After intercepting a student's connection packet, an unauthenticated attacker on the same network may replay the packet to create the false appearance that the student is still connected.