Read the docs
TI-2026-36725 Aliases CVE-2026-49819

UpSnap - Unauthenticated Initial-Superuser Takeover Chains to Root RCE via wake_cmd

Priority HIGH 82CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation, Security bypass, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269, CWE-306 and CWE-78.

Summary

UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in `pb.HandlerInitSuperuser` (`backend/pb/handlers.go:249`), reachable as `POST /api/upsnap/init-superuser`. The vulnerable code lacks any authentication, setup token, IP allow-list, or rate limit and is gated only by a `totalSuperusers > 0` count check — a condition that is false on every fresh install — allowing an unauthenticated network-adjacent attacker to register the initial superuser account, receive a long-lived JWT, and pivot to root remote code execution at `backend/networking/wake.go:43` (`exec.CommandContext(ctx, "/bin/sh", "-c", wake_cmd)`). Version 5.4.0 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0108 65th percentileScored 2026-11-07
Fix Fixed UpSnap (seriousm4x): 5.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
seriousm4xUpSnap4.4.1 to before 5.4.05.4.0Patch availableCNA
  • UpSnap Vendorseriousm4x Affected 4.4.1 to before 5.4.0 Fixed in 5.4.0 Patch available CNA

Remediation

  • Fix · CNA UpSnap (seriousm4x) Fixed in 5.4.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49819

References

Other 2

  • TI-2026-36633 UpSnap vulnerable to Remote Code Execution via IP Field Template Injection in wake_cmd/shutdown_cmd CVSS 3.1CRITICAL 9.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences