Unauthenticated Remote Code Execution in Voltronic Power SNMP Web Pro

Voltronic Power SNMP Web Pro 1.1 is susceptible to a critical unauthenticated remote code execution (RCE) vulnerability within the upload.cgi endpoint. The vulnerability arises from two primary flaws: the backend fails to validate session cookies, allowing unauthenticated access, and the firmware update functionality accepts and extracts user-supplied tar archives without validation. An attacker can craft a malicious archive containing an install.sh script and a custom CGI file. Once uploaded and triggered via the install parameter, the application executes the malicious script with root privileges, effectively dropping arbitrary CGI files into the web root. This allows for full system compromise on the affected ARM-based Linux device. As of August 12, 2026, no patch is available from the vendor, and public exploit code is available.

Attack Chain

1. The attacker identifies the upload.cgi endpoint, which does not require valid authentication; any arbitrary session cookie bypasses access controls.
2. The attacker performs a reconnaissance request to upload.cgi?params=extract to confirm file paths and directory expectations via echoed error messages.
3. The attacker crafts a malicious tar archive containing an install.sh script and a backdoor CGI script (e.g., pwned.cgi).
4. The attacker performs a multipart HTTP POST request to upload the crafted tar archive to the vulnerable server.
5. The attacker invokes the extraction process via GET /cgi-bin/upload.cgi?name=upgrade&?params=extract.
6. The attacker triggers the installation process via GET /cgi-bin/upload.cgi?name=upgrade&?params=install, which executes the install.sh script as root.
7. The install.sh script copies the backdoor CGI script into the web server's CGI directory and sets execute permissions.
8. The attacker executes arbitrary commands by requesting the deployed backdoor CGI script via HTTP, achieving full remote code execution with root privileges.

Impact

Successful exploitation results in full system compromise, allowing an attacker to execute arbitrary commands with root privileges on the device. This poses a significant risk to the availability, integrity, and confidentiality of the SNMP-managed power infrastructure. The exploit provides a persistent backdoor by installing a custom CGI handler, enabling ongoing unauthorized access to the underlying ARM Linux environment.

Recommendation

• Implement an Nginx or similar reverse proxy in front of all Voltronic Power SNMP Web Pro 1.1 instances to enforce strict authentication before reaching the web application.
• Deploy the Sigma rule below to detect attempts to access the vulnerable upload.cgi endpoint with common exploit parameters.
• Monitor network egress from the SNMP devices to detect unusual activity or shell execution following a POST request to the web interface.
• Block or restrict access to the web management interface of SNMP devices from any untrusted or external network segments.