Vulnerability Description
Voltronic Power SNMP Web Pro version 1.1 contains a pre-authentication path traversal vulnerability in the upload.cgi endpoint that allows unauthenticated attackers to read arbitrary files on the device filesystem by supplying directory traversal sequences in the params parameter. Attackers can exploit this vulnerability to disclose sensitive files such as password hashes, which can be cracked offline to obtain root-level access and enable full system compromise.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gvectors | Wpdiscuz | < 7.6.47 |
Related Weaknesses (CWE)
References
- https://github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22192-22199_Voltronic
- https://voltronicpower.com/
- https://www.boffsec-services.com/posts/sicuroweb-cve-2026-22191/
- https://www.vulncheck.com/advisories/voltronic-power-snmp-web-pro-path-traversal
- https://github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22192-22199_Voltronic
- https://www.boffsec-services.com/posts/sicuroweb-cve-2026-22191/
FAQ
What is CVE-2026-22199?
CVE-2026-22199 is a vulnerability with a CVSS score of 7.5 (HIGH). Voltronic Power SNMP Web Pro version 1.1 contains a pre-authentication path traversal vulnerability in the upload.cgi endpoint that allows unauthenticated attackers to read arbitrary files on the devi...
How severe is CVE-2026-22199?
CVE-2026-22199 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-22199?
Check the references section above for vendor advisories and patch information. Affected products include: Gvectors Wpdiscuz.