CVE-2026-89176

WeenyGenius, a computer lab management system developed by Howyar Technologies, does not authenticate endpoints, allowing unauthenticated attackers on the same network (CVSS 4.0 adjacent-network vector, no privileges or user interaction required) to impersonate student or teacher machines (CWE-306). An attacker triggers the flaw simply by sending traffic on the lab network while posing as a legitimate endpoint. Impersonating a student can disrupt normal classroom operations, while impersonating a teacher allows the attacker to induce student computers to initiate connections and thereby take remote control of those student endpoints. Any school or organization running WeenyGenius in a computer lab is affected, with all confidentiality, integrity, and availability impacts rated high because a compromised teacher endpoint yields full remote control of student machines. Exploitation has not been observed publicly: the flaw is not in CISA's KEV and no public proof-of-concept is known.

What to do: Contact Howyar Technologies for patched WeenyGenius releases and upgrade as soon as a fixed version is confirmed (no fixed version number is available in the current data). Until patched, limit and monitor access to lab networks — e.g., network segmentation or switch port security — since exploitation requires an attacker to be on the same LAN, and watch for unexpected teacher-endpoint connections initiated from student machines.