CVE-2026-44402

CriticalCVSS 9.8/10Last modified Sep 10, 2026

Description

Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote attackers to execute arbitrary commands as root by uploading a crafted tar archive without valid credentials. Attackers can supply a malicious tar archive containing arbitrary executable files that are extracted to a privileged directory and executed as root, achieving full system compromise.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Sep 4, 2026
Last modified: Sep 10, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-444037.2Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allow CVE-2026-444053.4In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm.CVE-2026-444067.8ZTE Cloud PC client uSmartView contains a DLL hijacking vulnerability; since uSmartViewServiceAgent.exe runs with SYSTEM privileges, success CVE-2026-444077.5A remote denial-of-service vulnerability exists in the ZTE Cloud PC client uSmartview, which may lead to memory corruption and remote denial CVE-2026-444086.3There is an unauthorized access vulnerability in ZTE MU5250. Due to improper permission control of the Web interface, an unauthorized attack CVE-2026-444097.5There is an an information disclosure vulnerability in ZTE MU5250. Due to improper configuration of the access control mechanism, attackers CVE-2026-44418.8Use after free in Base in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a craft CVE-2026-444103.8This vulnerability stems from a business logic flaw.Attackers can exploit legitimate application functions in unintended and abnormal ways, CVE-2026-444117.8A vulnerability has been identified in Solid Edge SE2026 (All versions < V226.0 Update 5). The affected application is vulnerable to uniniti CVE-2026-444127.8A vulnerability has been identified in Solid Edge SE2026 (All versions < V226.0 Update 5). The affected applications contain a stack based o CVE-2026-444137.5In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access CVE-2026-444146.8A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edge Device Kit - arm64 V1.10, Industrial Edge Device