Vulnerability details
CVE-2026-44402
Voltronic Power SNMP Web Pro
Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgi
CVSS 4.0
9.3Critical
Official description
Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote attackers to execute arbitrary commands as root by uploading a crafted tar archive without valid credentials. Attackers can supply a malicious tar archive containing arbitrary executable files that are extracted to a privileged directory and executed as root, achieving full system compromise.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.3Critical | 4.0 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 9.8Critical | 3.1 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Voltronic Power | SNMP Web Pro | 1.1 | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://github.com/Virgula0/CVE-2026-44402 technical-descriptionexploit
- https://voltronicpower.com/ product
- https://www.vulncheck.com/advisories/voltronic-power-snmp-web-pro-unauthenticated-rce-via-upload-cgi third-party-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-09-04
- Last updated
- 2026-10-01
- State
- Published
- Assigner (CNA)
- VulnCheck
Exploit prediction (EPSS)
1.31%
Probability of exploitation in 30 days
70.9%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Proof of concept
- Technical impact
- Total
Weaknesses (CWE)
- CWE-434Unrestricted Upload of File with Dangerous Type