Description
Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote attackers to execute arbitrary commands as root by uploading a crafted tar archive without valid credentials. Attackers can supply a malicious tar archive containing arbitrary executable files that are extracted to a privileged directory and executed as root, achieving full system compromise.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Voltronic Power | SNMP Web Pro | 1.1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
Virgula0/CVE-2026-44402 ★ 1 · Aug 12, 2026
Pre-Authenticated Full Root Remote Command Execution in Voltronic Power SNMP Web Pro 1.1
-
0xCyp1337/CVE-2026-44402 ★ 0 · Sep 6, 2026
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- Researcher Disclosure technical-description exploit
- Vendor Homepage product
- https://www.vulncheck.com/advisories/voltronic-power-snmp-web-pro-unauthenticated-rce-via-upload-cgi third-party-advisory