Voltronic Power vulnerabilities
Published CVEs affecting Voltronic Power products: 2 record(s), with severity, exploitation and fixes.
CVE-2026-22199
High · 7.5
CWE-22 Mar 13, 2026
Voltronic Power SNMP Web Pro 1.1 Path Traversal via upload.cgi
Voltronic Power SNMP Web Pro version 1.1 contains a pre-authentication path traversal vulnerability in the upload.cgi endpoint that allows unauthenticated attackers to read arbitrary files on the device filesystem by supplying directory traversal sequences in the params parameter. Attackers can exploit this vulnerability to disclose sensitive files such as password hashes, which can be cracked offline to obtain root-level access and enable full system compromise.
CVE-2026-22192
Critical · 9.9
CWE-306 Mar 13, 2026
Voltronic Power SNMP Web Pro 1.1 Authentication Bypass via localStorage
Voltronic Power SNMP Web Pro version 1.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to access privileged management functions by manipulating browser localStorage values. Attackers can modify client-side authentication state to bypass server-side access controls and gain unauthorized access to protected management functionality without valid credentials.