CVE-2026-44402: critical vulnerability in Voltronic Power SNMP Web Pro
Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgi
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.3epss 1.3%
from disclosure to weapon2 days
Published on NVDSep 4
1st PoC+2d
Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote attackers to execute arbitrary commands as root by uploading a crafted tar archive without valid credentials. Attackers can supply a malicious tar archive containing arbitrary executable files that are extracted to a privileged directory and executed as root, achieving full system compromise.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Voltronic Power · SNMP Web Propublic PoCs found — 2
cve_referencegithub.com/Virgula0/CVE-2026-44402★ 1githubgithub.com/0xCyp1337/CVE-2026-44402★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Voltronic Power SNMP Web Pro
In the same product, most dangerous first.