CVE-2026-44402

CRITICAL 9.8

Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgi

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote attackers to execute arbitrary commands as root by uploading a crafted tar archive without valid credentials. Attackers can supply a malicious tar archive containing arbitrary executable files that are extracted to a privileged directory and executed as root, achieving full system compromise.

CWE	CWE-434
Vendor	voltronic power
Product	snmp web pro
Published	Sep 4, 2026
Last Updated	Sep 4, 2026

Stay Ahead of the Next One

Get instant alerts for voltronic power snmp web pro

Be the first to know when new critical vulnerabilities affecting voltronic power snmp web pro are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Voltronic Power / SNMP Web Pro

1.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Virgula0/CVE-2026-44402 voltronicpower.com: https://voltronicpower.com/ vulncheck.com: https://www.vulncheck.com/advisories/voltronic-power-snmp-web-pro-unauthenticated-rce-via-upload-cgi

Credits

Angelo Rosa