CVE-2026-89178

WeenyGenius, a computer lab management system from Howyar Technologies, fails to properly validate the origin of broadcast packets, allowing an unauthenticated attacker on the same network to impersonate the teacher workstation. The attacker sends forged broadcast packets on the local network, which causes student client computers to initiate connections back to the attacker's machine. By impersonating the teacher workstation, the attacker can establish sessions with student computers and interact with or influence them, with CVSS 4.0 scoring high potential impact to confidentiality, integrity, and availability of the student clients. Organizations running WeenyGenius — typically schools and institutions with managed computer labs — are affected. There is no evidence of exploitation in the wild, no CISA KEV listing, and no public proof-of-concept at this time.

What to do: Check with Howyar Technologies and TWCERT/CC advisories for a patched release, since specific fixed version numbers were not provided in the available data. Until a patch is applied, mitigate by segmenting or restricting broadcast traffic on lab VLANs and limiting which hosts can send broadcast packets toward student clients, and monitor the lab network for unauthenticated hosts answering as the teacher workstation.