Loading vulnerability…
CVE-2026-44402 is an unrestricted file-upload vulnerability in Voltronic Power SNMP Web Pro 1.1's firmware-update functionality. The endpoint accepts attacker-controlled tar archives without authentication and does not adequately restrict archive contents. Attacker-supplied executable files are extracted into a privileged location and subsequently executed with root privileges.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
The repository contains one Python 3 exploit program and a README. CVE-2026-44402.py implements a network/web exploit chain against the claimed Voltronic Power SNMP Web Pro 1.1 firmware update interface. It constructs a tar archive containing embedded POSIX-shell install and CGI web-shell payloads, uploads it to upload.cgi, requests extraction, then requests installation. The installer is intended to run as root and deploys pwned.cgi under the web server CGI directory, allowing subsequent arbitrary commands via POST requests. The tool includes argparse-driven single-target and target-file modes, threaded mass exploitation, timeouts, optional proxy/output handling, response validation, colored status output, and a prompt_toolkit interactive shell. No established exploit framework is used. The payload is hardcoded but functional in design, so the repository is assessed as an operational exploit rather than a detection-only script.
Repository is a compact Python proof-of-concept exploit for CVE-2026-44402 affecting Voltronic Power SNMP Web Pro 1.1. The repo contains one main exploit script (poc.py), dependency list, a README with manual exploitation details, and two shell payload files under upgrade/ that mirror the archive contents generated dynamically by the Python code. Core exploit flow: poc.py creates a malicious tar.gz firmware archive in memory containing upgrade/install.sh and upgrade/pwned.cgi, uploads it to the vulnerable upload.cgi endpoint, triggers extract and install actions via GET requests, then checks whether the CGI backdoor was written to the target web root. If successful, it opens an interactive prompt that sends base64-wrapped shell commands to the deployed CGI over HTTP POST. Main capability is pre-authenticated/unauthenticated remote command execution as root by abusing the firmware update mechanism. The install.sh payload copies a CGI script into /var/www/html/web_pages/cgi-bin/pwned.cgi and marks it executable. The CGI script executes attacker-supplied shell commands via eval and returns stdout/stderr in the HTTP response. The Python wrapper improves reliability by base64-encoding commands before execution. Fingerprintable targets and paths are explicit: /cgi-bin/upload.cgi with params=upload/extract/install, deployed backdoor /cgi-bin/pwned.cgi, leaked archive path /root/upgrade.tar.gz, and installation path /var/www/html/web_pages/cgi-bin/pwned.cgi. README also documents the authentication bypass behavior using an invalid -http-session- cookie and shows example localhost test URLs. This is a real exploit, not just a detector. It includes a working payload and post-exploitation command channel, but it is still a standalone PoC rather than a framework-integrated or highly modular weaponized exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An unauthenticated remote code execution vulnerability in Voltronic Power SNMP Web Pro 1.1's upload.cgi firmware-update endpoint. A crafted tar archive can place executable files in a privileged directory, where they are executed as root, enabling full system compromise.
An unauthenticated, network-reachable remote-code-execution vulnerability in the upload.cgi firmware-update endpoint of Voltronic Power SNMP Web Pro 1.1. A crafted tar archive can cause arbitrary executables to be extracted to a privileged directory and run as root, resulting in full device compromise.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.