CVE-2026-44402CWE-434unrestricted-file-upload

CVE-2026-44402

Critical · published September 4, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
57.0
In the wild
Unconfirmed
What it is

Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote attackers to execute arbitrary commands as root by uploading a crafted tar archive without valid credentials. Attackers can supply a malicious tar archive containing arbitrary executable files that are extracted to a privileged directory and executed as root, achieving full system compromise.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00888 · 57.0th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-09-04T20:17Z
References (3)
https://github.com/Virgula0/CVE-2026-44402 · [email protected]https://voltronicpower.com/ · [email protected]https://www.vulncheck.com/advisories/voltronic-power-snmp-web-pro-unauthenticated-rce-via-upload-cgi · [email protected]
EPSS history
Timeline
  • 06 SEP 03:32Z
    EPSS moved — → 1%
    epss
  • 04 SEP 15:31Z
    Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgi
    cvelistv5