CVE-2026-89179 describes a CWE-353 vulnerability in Howyar's WeenyGenius system where the lack of integrity checks enables attackers on the same network to perform replay attacks on student connection packets. This allows attackers to forge the appearance that a student remains connected to the system. The vulnerability affects versions >=0 and <=12.2.031. No known exploits are reported in the wild, and no vendor patch or remediation information is provided.

An attacker on the same network can replay intercepted connection packets to impersonate a student's active connection. This could lead to unauthorized access or misuse of the system's session management, potentially disrupting lab management operations or bypassing connection controls. The impact is limited to session integrity and does not involve privilege escalation or data confidentiality breaches.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is provided, organizations should consider network-level protections such as isolating lab management traffic or using secure communication channels to mitigate replay risks until a fix is available.