CVE-2026-41446: Snap One WattBox 800/820: hard-coded credentials in diagnostic endpoints allow root command execution

Overview

CVE-2026-41446 affects Snap One WattBox 800 and 820 series devices running firmware prior to 2.10.0.0. According to the record, the devices expose undisclosed diagnostic HTTP endpoints that rely on the device MAC address and service tag for authentication, and both values are printed in plaintext on the physical label. The weakness is classified as CWE-798, use of hard-coded credentials.

Impact

The record states that an attacker with the label or documentation values can execute arbitrary commands as root on the device. The CVSS 3.1 vector reported by VulnCheck (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) corresponds to a base score of 9.8, and a CVSS 4.0 score of 9.2 is also listed. Because the authentication values are static and visible on the label, the practical barrier may be low for anyone who obtains that information (inference).

Affected products and versions

Snap One WattBox 800 series firmware prior to 2.10.0.0, as stated in the description.
Snap One WattBox 820 series firmware prior to 2.10.0.0, as stated in the description.

The structured affected and fixes fields in the record are empty. Exact affected version ranges and the confirmed fixed release are therefore unknown from this record.

Exploitation status

This CVE is not listed in the CISA KEV catalog in the data consulted. No confirmed active exploitation or exploitation in the wild appears in the sources consulted. The record includes an EPSS probability of 0.00774 and a percentile of 0.54578.

Remediation and mitigation

Inventory all WattBox 800 and 820 series devices and record their firmware versions.
Review the vendor release notes linked in the references and apply the vendor firmware update. Confirm with Snap One which release contains the fix, because the record does not name one.
Until devices are updated, keep management interfaces off untrusted networks and restrict access to authorized administrative hosts.
Treat device labels and installation documentation that contain the MAC address and service tag as sensitive, and limit where they are stored or shared.
Where immediate updates are not possible, use network segmentation to limit which systems can reach the devices.

Detection guidance

Review network telemetry for HTTP access to WattBox devices from hosts that are not expected administrative systems.
Monitor device and network logs for unusual administrative activity, and investigate unexpected configuration or process changes on the device.
Maintain an asset inventory that links each device to its firmware version so exposure can be assessed quickly.

Limitations of the available information

The record lists no affected or fixed version ranges in its structured fields, does not describe the diagnostic endpoints, and has a source status of Awaiting Analysis. The only listed vendor reference is a release notes page whose content is not reproduced in the record, so the fix status is unknown. Any details beyond the description are unknown.

Frequently asked questions

What is CVE-2026-41446?

It is a hard-coded credential weakness (CWE-798) in Snap One WattBox 800 and 820 series firmware prior to 2.10.0.0. Undisclosed diagnostic HTTP endpoints accept the MAC address and service tag, which are printed on the device label.

Is this CVE known to be actively exploited?

No. This CVE is not listed in the CISA KEV catalog in the data consulted, and no confirmed active exploitation appears in the sources consulted.

What should administrators do now?

Inventory affected devices, confirm the fixed firmware release with the vendor, apply updates when available, and restrict network access to management interfaces in the meantime.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.