CVE-2026-89179: WeenyGenius Authentication Bypass Vulnerability

CVE-2026-89179 Overview

CVE-2026-89179 affects WeenyGenius, a computer lab management system developed by Howyar Technologies. The vulnerability stems from a missing integrity check [CWE-353] on network packets used to track student session state. Unauthenticated attackers on the same network can capture a student's connection packet and replay it to forge continued session presence. This allows a student to appear connected to the management console while the actual endpoint is disconnected or being misused.

Critical Impact

An adjacent-network attacker can replay session packets to spoof student connection status, undermining the integrity of lab attendance and monitoring data.

Affected Products

• Howyar Technologies WeenyGenius (computer lab management system)

Discovery Timeline

• 2026-09-11 - CVE-2026-89179 published to NVD
• 2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89179

Vulnerability Analysis

WeenyGenius uses network packets to signal that a student endpoint remains actively connected to the lab management server. These packets lack cryptographic integrity protection such as message authentication codes, sequence validation, or nonce-based freshness checks. An attacker on the same broadcast domain can passively capture a legitimate connection packet and later retransmit it to the server. The server accepts the replayed packet as evidence of an ongoing session.

The attack does not require credentials, user interaction, or elevated privileges. Impact is limited to session-state integrity rather than confidentiality or availability, which aligns with the medium severity rating.

Root Cause

The root cause is Missing Support for Integrity Check [CWE-353]. WeenyGenius does not validate the authenticity or freshness of client presence packets. Without an authenticated timestamp, nonce, or session-bound signature, identical packets are indistinguishable to the server whether transmitted by the legitimate client or a replay attacker.

Attack Vector

Exploitation requires adjacent-network access, such as the same physical LAN or Wi-Fi segment used by student endpoints. The attacker performs passive traffic capture to obtain a valid session packet from a target student. The attacker then replays the packet at intervals matching the application's keepalive expectations. The management server records the student as connected despite the actual endpoint being offline or reassigned.

Refer to the TW-CERT Security Advisory 11200 and TW-CERT Security Advisory 11201 for vendor-provided technical details.

Detection Methods for CVE-2026-89179

Indicators of Compromise

• Duplicate WeenyGenius session packets originating from unexpected MAC or IP addresses on the lab network.
• Student sessions reporting as connected while corresponding endpoint telemetry shows the host powered off or logged out.
• ARP or DHCP anomalies indicating unauthorized devices attached to the lab VLAN.

Detection Strategies

• Deploy network intrusion detection rules that flag repeated identical WeenyGenius keepalive packets from the same source over short intervals.
• Correlate lab management server session logs with endpoint agent telemetry to identify presence mismatches.
• Monitor Layer 2 traffic on lab VLANs for unauthorized promiscuous-mode devices consistent with packet capture activity.

Monitoring Recommendations

• Enable switch port security and 802.1X authentication on lab access ports to restrict unauthorized devices.
• Log and review WeenyGenius session connect and disconnect events for anomalies against physical attendance records.
• Alert on any host generating a disproportionate volume of WeenyGenius protocol traffic relative to peer endpoints.

How to Mitigate CVE-2026-89179

Immediate Actions Required

• Contact Howyar Technologies to obtain the latest WeenyGenius release addressing CVE-2026-89179.
• Isolate the lab management server and student endpoints on a dedicated VLAN with strict access control.
• Enable wired 802.1X and WPA3-Enterprise on Wi-Fi to prevent unauthorized adjacent-network access.

Patch Information

Howyar Technologies has published guidance through TW-CERT. Review the TW-CERT Security Advisory 11200 and TW-CERT Security Advisory 11201 for vendor-supplied remediation and upgrade instructions.

Workarounds

• Restrict lab network access to managed endpoints using MAC filtering, 802.1X, or network access control.
• Segment student endpoints from any device capable of packet capture or spoofing on the same broadcast domain.
• Cross-verify session presence with an out-of-band signal such as endpoint agent heartbeats or physical attendance checks.

# Example: restrict a Cisco switch port to a single learned MAC to limit adjacent-network spoofing
interface GigabitEthernet0/1
  switchport mode access
  switchport port-security
  switchport port-security maximum 1
  switchport port-security mac-address sticky
  switchport port-security violation shutdown