CVE-2026-44402

Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgi

Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote attackers to execute arbitrary commands as root by uploading a crafted tar archive without valid credentials. Attackers can supply a malicious tar archive containing arbitrary executable files that are extracted to a privileged directory and executed as root, achieving full system compromise.

Affected

Voltronic Power · SNMP Web Pro

CVSS v4.0 VULNCHECK

9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 VULNCHECK

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

1.32% chance of exploitation in the next 30 days, 70th percentile

Published

2026-09-04

Updated

2026-10-01

Proof-of-concept exploits (2)

• Virgula0/CVE-2026-444021★ · 2026-08-12
• 0xCyp1337/CVE-2026-444020★ · 2026-09-06

References

• CVE Record
• NVD entry

Related

• CVE-2018-10933
• CVE-2025-6440
• CVE-2026-10196
• CVE-2026-19598
• CVE-2026-48907
• CVE-2026-57811