CVSS 4.0
8.8 highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:NCVE-2026-22192
High (8.8) in gvectors wpdiscuz. EPSS 0.3% chance of exploitation in the next 30 days.
Voltronic Power SNMP Web Pro version 1.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to access privileged management functions by manipulating browser localStorage values. Attackers can modify client-side authentication state to bypass server-side access controls and gain unauthorized access to protected management functionality without valid credentials.
Severity
CVSS 3.1
9.9 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
- CWE
- CWE-306
- Published
- Modified
- Record from
- the NVD, synced
Affected
- gvectors:wpdiscuz
References
- https://github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22192-22199_Voltronic-Power_Preauth_root_RCE.txt
- https://voltronicpower.com/
- https://www.boffsec-services.com/posts/sicuroweb-cve-2026-22191/
- https://www.vulncheck.com/advisories/voltronic-power-snmp-web-pro-authentication-bypass-via-localstorage