CVE-2026-44402: Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgi
Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote attackers to execute arbitrary commands as root by uploading a crafted tar archive without valid credentials. Attackers can supply a malicious tar archive containing arbitrary executable files that are extracted to a privileged directory and executed as root, achieving full system compromise.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
No authentication or user interaction is required. A remote attacker only needs network access to the affected SNMP Web Pro web interface and the ability to submit a crafted tar archive to the upload.cgi endpoint.
What level of compromise can successful exploitation provide?
The crafted archive can cause arbitrary executable files to be extracted into a privileged directory and run as root. Successful exploitation can therefore result in full compromise of the affected system, including confidentiality, integrity, and availability impacts.
Which deployments should be considered exposed?
SNMP Web Pro 1.1 deployments whose web interface is reachable by an attacker should be considered exposed, because the vulnerable firmware-update endpoint does not require valid credentials. The supplied data does not identify any configuration prerequisite beyond access to that endpoint.