CVE-2026-89177 is a Use of Insecure Protocol vulnerability in Howyar's WeenyGenius system. The product relies on ZMTP Null mode, which lacks authentication and encryption, enabling attackers on the same network segment to intercept packets and leak sensitive data. Additionally, attackers can replay captured commands or forge commands to disrupt the system's normal operation. This vulnerability is classified under CWE-757 (Use of a Broken or Risky Cryptographic Algorithm), CWE-319 (Cleartext Transmission of Sensitive Information), and CWE-353 (Missing Support for Integrity Check).

An unauthenticated attacker on the same network can capture sensitive data transmitted by WeenyGenius and perform replay attacks with forged commands. This can lead to leakage of transmitted data and disruption of classroom operations managed by the system. The vulnerability does not require user interaction or privileges, increasing its risk in local network environments.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restricting network access to trusted users and segments may reduce exposure. Consider monitoring network traffic for suspicious activity related to ZMTP protocol usage.