CVE-2026-22199
Published: 13 March 2026
Summary
CVE-2026-22199 is a high-severity Path Traversal (CWE-22) vulnerability in Gvectors Wpdiscuz. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 42.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SC-14 (Public Access Protections).
Deeper analysis
Voltronic Power SNMP Web Pro version 1.1 is affected by CVE-2026-22199, a pre-authentication path traversal vulnerability in the upload.cgi endpoint. This flaw, classified under CWE-22, enables unauthenticated attackers to read arbitrary files on the device filesystem by injecting directory traversal sequences into the params parameter. Published on 2026-03-13 with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), it poses a significant confidentiality risk due to its network accessibility and lack of authentication requirements.
Unauthenticated remote attackers can exploit this vulnerability with low complexity to disclose sensitive files, including password hashes. Once obtained, these hashes can be cracked offline, granting root-level access and enabling full system compromise. The attack requires no user interaction or privileges, making it highly practical for opportunistic exploitation against exposed instances of the software.
Advisories from sources like VulnCheck and proof-of-concept exploits on GitHub (e.g., for related CVEs in the 22192-22199 range) document the path traversal leading to root RCE via credential disclosure, but no specific patches or mitigations are detailed in the available references. Security practitioners should isolate exposed Voltronic Power SNMP Web Pro devices and monitor for traversal attempts in upload.cgi traffic.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-11745
Vulnerability details
Voltronic Power SNMP Web Pro version 1.1 contains a pre-authentication path traversal vulnerability in the upload.cgi endpoint that allows unauthenticated attackers to read arbitrary files on the device filesystem by supplying directory traversal sequences in the params parameter. Attackers can…
more
exploit this vulnerability to disclose sensitive files such as password hashes, which can be cracked offline to obtain root-level access and enable full system compromise.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Pre-auth path traversal in public-facing upload.cgi directly enables T1190 for remote file access; arbitrary filesystem reads specifically disclose password hashes (T1552.001) leading to root compromise.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation of inputs at endpoints like upload.cgi to reject directory traversal sequences in the params parameter, directly preventing arbitrary file reads.
SC-14 enforces strict authorizations and limitations on publicly accessible web interfaces like upload.cgi to block unauthenticated path traversal attacks.
AC-3 enforces logical access controls on filesystem resources to restrict unauthenticated reading of arbitrary sensitive files such as password hashes.