VULNERABILITY INTELLIGENCE
CVE-2026-44402
CVSS score9.8 CRITICAL
EPSS probability1.32%
CISA KEVNot currently listed
Published2026-09-04
Last modified2026-09-10
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote attackers to execute arbitrary commands as root by uploading a crafted tar archive without valid credentials. Attackers can supply a malicious tar archive containing arbitrary executable files that are extracted to a privileged directory and executed as root, achieving full system compromise.
Weakness classification
- disclosure@vulncheck.com: CWE-434