Description

Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote attackers to execute arbitrary commands as root by uploading a crafted tar archive without valid credentials. Attackers can supply a malicious tar archive containing arbitrary executable files that are extracted to a privileged directory and executed as root, achieving full system compromise.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-04T16:17:25.250Z",
  "pubdate": "2026-09-04T16:17:25.250Z",
  "executiveSummary": "Voltronic Power SNMP Web Pro 1.1 contains a critical remote code execution vulnerability originating from an insecure implementation of the firmware update mechanism.\nThe vulnerability resides in the upload.cgi endpoint, which fails to implement authentication or adequate input validation for incoming tar archives.\nUnauthenticated remote attackers can leverage this flaw to upload maliciously crafted tar archives containing arbitrary executable code.\nDue to the execution context of the firmware update process, these files are extracted into privileged system directories and executed with root-level permissions.\nThe impact of this vulnerability is a full system compromise, allowing attackers to gain persistent administrative control over the affected hardware.\nThis represents a severe security risk, enabling unauthorized data access, network disruption, or lateral movement within the target environment.\nNo pre-existing credentials are required for exploitation, and the flaw is accessible over the network via the web interface of the SNMP Web Pro card.\nOrganizations utilizing affected Voltronic Power devices are at extreme risk of complete device takeover if the administrative interface is reachable by unauthorized parties.",
  "technicalDetails": "The vulnerability is identified within the firmware update functionality hosted on the upload.cgi script within the Voltronic Power SNMP Web Pro 1.1 web application.\nThe root cause is a lack of authentication checks and improper validation of file structures during the archive extraction process performed by the server-side update handler.\nThe application accepts tar archives submitted via an HTTP POST request to upload.cgi without verifying the sender's identity or the integrity/provenance of the archive contents.\nAn attacker can construct a malicious tar archive that leverages path traversal or direct file replacement techniques to place executable binaries or scripts into critical system paths that are subsequently called by the firmware update routine.\nWhen the web server processes the uploaded archive, it performs an extraction operation with root privileges. Because the archive is not sanitized, the system overwrites legitimate configuration or binary files with malicious payloads supplied by the attacker.\nThe exploitation flow begins with the attacker crafting an archive containing an executable payload. The attacker sends this payload to the upload.cgi endpoint. The web server, operating under an administrative context, extracts the contents of the archive to the filesystem without validating the destination paths of the contained files.\nOnce the malicious file is placed into a privileged directory—such as an init script location or a cron directory—the system either immediately executes the file or triggers it upon the next system state change or reboot. Because the web server process runs with root privileges, the executed payload inherits this level of access.\nPost-exploitation, the attacker achieves arbitrary code execution as root. This allows for the installation of persistent backdoors, modification of device firmware, interception of network traffic passing through the SNMP card, or the use of the device as a pivot point for further lateral movement within the network infrastructure.\nThe vulnerability is inherent to the design of the update mechanism in version 1.1, as it assumes that all files uploaded to the update endpoint are legitimate firmware components, failing to account for an adversarial actor injecting arbitrary instructions into the update stream."
}