CVE-2026-44402
Received Received - Intake

Unauthenticated Remote Code Execution in Voltronic Power SNMP Web Pro

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote attackers to execute arbitrary commands as root by uploading a crafted tar archive without valid credentials. Attackers can supply a malicious tar archive containing arbitrary executable files that are extracted to a privileged directory and executed as root, achieving full system compromise.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-44402
EUVD
EUVD-2026-71267

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
voltronic_power snmp_web_pro 1.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated remote code execution vulnerability in Voltronic Power SNMP Web Pro 1.1. It exists in the upload.cgi firmware update endpoint, allowing attackers to upload malicious tar archives without credentials. These archives contain executable files that are extracted to privileged directories and run as root, enabling full system compromise.

Detection Guidance

Check for unusual network traffic to the upload.cgi endpoint on Voltronic Power SNMP Web Pro 1.1. Monitor for unauthorized tar archive uploads or unexpected CGI script executions. Inspect system logs for root-level command execution attempts or files placed in privileged directories.

Impact Analysis

An attacker could gain complete control over the affected system by executing arbitrary commands as root. This could lead to data theft, system damage, or the device being used as a pivot point for further attacks within a network.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access controls. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately restrict access to the upload.cgi endpoint using a firewall or network segmentation. Deploy an nginx reverse proxy with authentication to block unauthenticated requests. Disable or remove the SNMP Web Pro 1.1 service if not essential until a patch is available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44402. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart