CVE-2026-22192 | BDVDB-2026-320342 Detail
Voltronic PowerSNMP Web Pro
Description#
Voltronic Power SNMP Web Pro version 1.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to access privileged management functions by manipulating browser localStorage values. Attackers can modify client-side authentication state to bypass server-side access controls and gain unauthorized access to protected management functionality without valid credentials.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact high, availability impact low. Attack vector: network.
Weaknesses#
- CWE-306 Missing Authentication for Critical Function
References#
- https://github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22192-22199_Voltronic-Power_Preauth_root_RCE.txt
- https://www.boffsec-services.com/posts/sicuroweb-cve-2026-22191/
- https://voltronicpower.com/
- https://www.vulncheck.com/advisories/voltronic-power-snmp-web-pro-authentication-bypass-via-localstorage
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.