CVE-2026-41446 - Vulnerability Analysis

Overview

Snap One WattBox 800 and 820 series firmware < 2.10.0.0 contain a command injection caused by undisclosed diagnostic HTTP endpoints requiring only device MAC address and service tag for authentication, letting attackers execute arbitrary commands as root, exploit requires physical access to device label.

Severity & Score

Impact

Attackers with device label access can execute arbitrary commands as root, leading to full device compromise.

Mitigation

Update to firmware version 2.10.0.0 or later.

References

• https://help.snapone.com/wb-8x0-fw/Content/FW%20RN/8x0/8x0%20series%20FW%20RN.htm

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner