A critical unauthenticated remote code execution vulnerability in Voltronic Power SNMP Web Pro allows remote attackers to achieve full system compromise with root-level privileges.

The application contains an unrestricted file upload flaw in the firmware update functionality (upload.cgi). Attackers can bypass authentication by providing an invalid session cookie and subsequently upload a malicious tar archive that is extracted to a privileged directory and executed as root.

Successful exploitation of this vulnerability grants an attacker full control over the affected device. Given the root-level execution, this could lead to complete data exfiltration, the installation of persistent backdoors, or the use of the device as a pivot point for further lateral movement within the network. With a CVSS score of 9.8, this vulnerability represents an extreme risk to infrastructure integrity and confidentiality.

Immediate Action: Update Voltronic Power SNMP Web Pro to the latest available version provided by the vendor. Ensure that any device currently running version 1.1 is taken offline or isolated until the patch is successfully applied.

Proactive Monitoring: Monitor network traffic for suspicious POST requests directed at the /cgi-bin/upload.cgi endpoint. Review system logs for unauthorized file extractions or the execution of unexpected processes originating from the /root directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests to the upload.cgi endpoint that do not originate from authorized administrative IP addresses. Restrict access to the device management interface to a secure, segmented management network.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub (Virgula0/CVE-2026-44402).

Due to the critical nature of this vulnerability and the availability of functional proof-of-concept code, immediate remediation is required. Administrators must prioritize updating all instances of Voltronic Power SNMP Web Pro to the patched version. Failure to act promptly exposes the entire network segment to high-impact unauthorized access and potential system-wide compromise.