Critical severity · published Mar 13, 2026
CVE-2026-22192
Voltronic Power SNMP Web Pro 1.1 Authentication Bypass via localStorage
9.9
CVSS
0.3%
EPSS
No
On KEV
Description
Voltronic Power SNMP Web Pro version 1.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to access privileged management functions by manipulating browser localStorage values. Attackers can modify client-side authentication state to bypass server-side access controls and gain unauthorized access to protected management functionality without valid credentials.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
High
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SW
SNMP Web Pro · Voltronic Power
1.1 · source: vendor
WP
Wpdiscuz · Gvectors
before 7.6.47 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-22192
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-22192
github.com
https://github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22192-22199_Voltronic-Power_Preauth_root_RCE.txt
voltronicpower.com
https://voltronicpower.com/
www.boffsec-services.com
https://www.boffsec-services.com/posts/sicuroweb-cve-2026-22191/
www.vulncheck.com
https://www.vulncheck.com/advisories/voltronic-power-snmp-web-pro-authentication-bypass-via-localstorage
More from SNMP Web Pro
9.8
CVE-2026-44402
Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgi
7.5
CVE-2026-22199
Voltronic Power SNMP Web Pro 1.1 Path Traversal via upload.cgi