CVE-2026-44402: Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgi

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-04 · updated 2026-09-10
Weakness: CWE-434

Description

Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote attackers to execute arbitrary commands as root by uploading a crafted tar archive without valid credentials. Attackers can supply a malicious tar archive containing arbitrary executable files that are extracted to a privileged directory and executed as root, achieving full system compromise.

Affected products

Voltronic Power SNMP Web Pro: 1.1

References

https://github.com/Virgula0/CVE-2026-44402
https://voltronicpower.com/
https://www.vulncheck.com/advisories/voltronic-power-snmp-web-pro-unauthenticated-rce-via-upload-cgi

Get alerted when CVE-2026-44402 or the next vulnerability affects your stack