Vulnerabilidades do Voltronic Power SNMP Web Pro
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Voltronic Power SNMP Web Pro: 3 registro(s), com versões afetadas e correções.
CVE-2026-44402
Crítica · 9.8
CWE-434 04/09/2026
Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgi
Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote attackers to execute arbitrary commands as root by uploading a crafted tar archive without valid credentials. Attackers can supply a malicious tar archive containing arbitrary executable files that are extracted to a privileged directory and executed as root, achieving full system compromise.
CVE-2026-22199
Alta · 7.5
CWE-22 13/03/2026
Voltronic Power SNMP Web Pro 1.1 Path Traversal via upload.cgi
Voltronic Power SNMP Web Pro version 1.1 contains a pre-authentication path traversal vulnerability in the upload.cgi endpoint that allows unauthenticated attackers to read arbitrary files on the device filesystem by supplying directory traversal sequences in the params parameter. Attackers can exploit this vulnerability to disclose sensitive files such as password hashes, which can be cracked offline to obtain root-level access and enable full system compromise.
CVE-2026-22192
Crítica · 9.9
CWE-306 13/03/2026
Voltronic Power SNMP Web Pro 1.1 Authentication Bypass via localStorage
Voltronic Power SNMP Web Pro version 1.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to access privileged management functions by manipulating browser localStorage values. Attackers can modify client-side authentication state to bypass server-side access controls and gain unauthorized access to protected management functionality without valid credentials.