Read the docs
TI-2026-30035 Aliases CVE-2026-41446GHSA-f7pq-m4g9-frrj

WattBox 800 & 820 Series < 2.10.0.0 RCE via Diagnostic Endpoints

Priority MEDIUM 48CWE-798Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-798.

Summary

Snap One WattBox 800 and 820 series firmware versions prior to 2.10.0.0 contain undisclosed diagnostic HTTP endpoints that require only the device MAC address and service tag for authentication, both of which are printed in plaintext on the physical device label. Attackers with access to the device label or documentation containing these values can authenticate to the several endpoints and execute arbitrary commands as root on the device.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00433 37th percentileScored 2026-11-07
Fix Fixed WattBox 800 (Snap One, LLC): 2.10.0.0WattBox 820 (Snap One, LLC): 2.10.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Snap OneWattBox 800before 2.10.0.02.10.0.0Patch availableCNA
Snap OneWattBox 820before 2.10.0.02.10.0.0Patch availableCNA
  • WattBox 800 VendorSnap One Affected before 2.10.0.0 Fixed in 2.10.0.0 Patch available CNA
  • WattBox 820 VendorSnap One Affected before 2.10.0.0 Fixed in 2.10.0.0 Patch available CNA

Remediation

  • Fix · CNA WattBox 800 (Snap One, LLC) Fixed in 2.10.0.0
  • Fix · CNA WattBox 820 (Snap One, LLC) Fixed in 2.10.0.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41446
  2. 2026-10-03 Alias added: GHSA-f7pq-m4g9-frrj
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Patch 1

  • TI-2023-14947 Snap One OvrC cloud servers contain a route an attacker can use to bypass requirements and claim devices outright. CVSS 3.1CRITICAL 10.0
  • TI-2023-09413 Heap-based buffer overflow in Snap One Wattbox WB-300-IP-3 CVSS 3.1CRITICAL 9.8
  • TI-2023-14946 Snap One OvrC Pro versions prior to 7.2 have their own locally running web server… CVSS 3.1CRITICAL 9.8
  • TI-2023-09805 Missing brute-force protection in Snap One Wattbox WB-300-IP-3 CVSS 3.1CRITICAL 9.8
  • TI-2023-12932 Insufficient verification of data authenticity in Snap One OvrC Cloud CVSS 3.1CRITICAL 9.8
  • TI-2024-33816 Missing Authentication for Critical Function in Snap One OVRC cloud CVSS 4.0HIGH 8.8
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences