CVE-2026-89177

WeenyGenius, a computer lab management system from Howyar Technologies, communicates using ZMTP in Null mode, which provides no encryption or authentication for traffic exchanged between the instructor console and lab client machines. An unauthenticated attacker on the same network can passively capture packets to leak whatever data the system transmits, or actively replay and forge commands to disrupt classroom operations. The attack requires only adjacent network access (no privileges and no user interaction) and can cause high-impact loss of confidentiality, integrity, and availability on the affected lab systems per its CVSS 4.0 score of 8.7. Any organization running WeenyGenius, typically schools or training centers with managed computer labs, is affected; the available data does not specify vulnerable version ranges. There are currently no reports of in-the-wild exploitation, no known public proof-of-concept, and the issue is not listed in CISA's KEV catalog.

What to do: Segment WeenyGenius deployments (e.g., a dedicated lab VLAN) so that only authorized lab machines share the network, since the attack requires adjacent network access. Contact Howyar Technologies for a patched release and upgrade lab machines when one is available, as no fixed version is specified in the available data; in the meantime, monitor lab networks for unexpected or replayed client commands.