Attack Chain

1. The attacker identifies the upload.cgi endpoint, which does not require valid authentication; any arbitrary session cookie bypasses access controls.
2. The attacker performs a reconnaissance request to upload.cgi?params=extract to confirm file paths and directory expectations via echoed error messages.
3. The attacker crafts a malicious tar archive containing an install.sh script and a backdoor CGI script (e.g., pwned.cgi).
4. The attacker performs a multipart HTTP POST request to upload the crafted tar archive to the vulnerable server.
5. The attacker invokes the extraction process via GET /cgi-bin/upload.cgi?name=upgrade&?params=extract.
6. The attacker triggers the installation process via GET /cgi-bin/upload.cgi?name=upgrade&?params=install, which executes the install.sh script as root.
7. The install.sh script copies the backdoor CGI script into the web server's CGI directory and sets execute permissions.
8. The attacker executes arbitrary commands by requesting the deployed backdoor CGI script via HTTP, achieving full remote code execution with root privileges.

Impact

Successful exploitation results in full system compromise, allowing an attacker to execute arbitrary commands with root privileges on the device. This poses a significant risk to the availability, integrity, and confidentiality of the SNMP-managed power infrastructure. The exploit provides a persistent backdoor by installing a custom CGI handler, enabling ongoing unauthorized access to the underlying ARM Linux environment.

Recommendation

• Implement an Nginx or similar reverse proxy in front of all Voltronic Power SNMP Web Pro 1.1 instances to enforce strict authentication before reaching the web application.
• Deploy the Sigma rule below to detect attempts to access the vulnerable upload.cgi endpoint with common exploit parameters.
• Monitor network egress from the SNMP devices to detect unusual activity or shell execution following a POST request to the web interface.
• Block or restrict access to the web management interface of SNMP devices from any untrusted or external network segments.