CVE Intelligence
Analysis AI-assisted

CVE-2026-22192: Voltronic Power SNMP Web Pro Authentication Bypass via localStorage

CVE-2026-22192 affects Voltronic Power SNMP Web Pro version 1.1 and is described as an authentication bypass in which browser localStorage values can be altered to reach privileged management functions. VulnCheck, the CNA, assigns a score of 9.9 while NVD lists 5.4 for the same product. The record lists no fixed version, and the CVE is not in CISA KEV.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-22192 is described by the CNA VulnCheck as an authentication bypass in Voltronic Power SNMP Web Pro version 1.1. According to the record, authentication state held in browser localStorage can be changed so that server-side access controls fail to block access to management functions. The weakness is classified as CWE-306, missing authentication for a critical function.

Impact

  • Confirmed by the record: an unauthenticated attacker could reach privileged management functionality without valid credentials.
  • Confirmed scores: the VulnCheck CVSS base score is 9.9 and the NVD CVSS base score is 5.4.
  • Inference: the gap between the two scores probably reflects different impact or scope assessments, but the sources consulted do not explain it.

Affected products and versions

  • Voltronic Power SNMP Web Pro version 1.1 is the product named in the description and the only Voltronic version listed in the record.
  • The record also lists Gvectors Wpdiscuz before 7.6.47 as an affected product. This entry does not match the Voltronic description and appears to be a data inconsistency, so it should not be treated as confirmed for this CVE without checking the CNA's data.
  • No fixed version is listed in the record. This is unknown, not evidence that no fix exists.

Exploitation status

The record shows this CVE is not listed in CISA KEV. No confirmed exploitation appears in the sources consulted. The SSVC data in the record marks exploitation as none and automatable as no, and the EPSS probability is 0.0028.

Remediation and mitigation

  • Ask the vendor at voltronicpower.com for an updated release, since the record provides no fix details.
  • Until a fix is confirmed, limit access to the management interface to trusted administrative networks and place it behind additional access controls.
  • Treat browser-side state as untrusted. Confirm with the vendor that authorization is enforced on the server for the version in use.
  • Read the VulnCheck advisory for the CNA's description.

Detection guidance

  • Review management interface logs for administrative requests from unexpected sources or without a matching login event.
  • Monitor for unusual changes in client-side session state and for administrative actions that lack an authenticated session.
  • Build an inventory of devices running version 1.1 so monitoring and patching can be prioritised.

Limitations of the available information

The record does not identify the affected endpoints, the exact localStorage values involved, or a vendor advisory. No fixed version is listed. The VulnCheck and NVD scores differ, and the record contains an unrelated affected product entry. This analysis does not reproduce technical details from the referenced materials.

Frequently asked questions

Is CVE-2026-22192 being actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted. Exploitation status should be rechecked as new information appears.

Is there a fixed version for this vulnerability?

The record lists no fixed version. That is unknown rather than proof that no fix exists, so the vendor should be contacted for update details.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.