CVE-2026-41446: Snap One WattBox RCE Vulnerability

CVE-2026-41446 Overview

CVE-2026-41446 is a critical hardcoded credentials vulnerability affecting Snap One WattBox 800 and 820 series power distribution units. The firmware versions prior to 2.10.0.0 contain undisclosed diagnostic HTTP endpoints that rely solely on the device MAC address and service tag for authentication. Both of these values are printed in plaintext on the physical device label, creating a trivial authentication bypass for attackers who can access or photograph the device label.

This vulnerability allows remote attackers with network access to the device to execute arbitrary commands with root privileges, resulting in complete device compromise.

Critical Impact

Attackers with knowledge of the device MAC address and service tag (available on the physical label) can authenticate to hidden diagnostic endpoints and execute arbitrary commands as root, leading to full device takeover.

Affected Products

• Snap One WattBox 800 series firmware versions prior to 2.10.0.0
• Snap One WattBox 820 series firmware versions prior to 2.10.0.0

Discovery Timeline

• 2026-04-28 - CVE-2026-41446 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-41446

Vulnerability Analysis

This vulnerability stems from a fundamentally flawed authentication design (CWE-798: Use of Hard-Coded Credentials). The WattBox 800 and 820 series devices expose diagnostic HTTP endpoints that were likely intended for factory testing or technical support purposes. Instead of implementing proper authentication mechanisms, these endpoints only require two pieces of information for access: the device MAC address and the service tag.

The critical security flaw is that both authentication values are printed directly on the physical device label in plaintext. This means anyone with physical proximity to the device—including building maintenance staff, delivery personnel, or visitors—can photograph or record these values. Additionally, installation documentation, invoices, or asset management systems may contain these values, further expanding the attack surface.

Once authenticated to the diagnostic endpoints, attackers gain the ability to execute arbitrary commands with root privileges on the underlying Linux-based firmware. This grants complete control over the power distribution unit, enabling attackers to manipulate power to connected equipment, establish persistence, pivot to other network devices, or cause physical damage through power cycling.

Root Cause

The root cause is the use of hardcoded, static credentials (MAC address and service tag) that are permanently printed on the device and cannot be changed by the end user. This design violates fundamental security principles by relying on "security through obscurity" rather than proper cryptographic authentication.

The device MAC address is also broadcast on the network and can be discovered through ARP scanning, DHCP logs, or network monitoring tools. Combined with social engineering or physical access to obtain the service tag, this creates a low-barrier attack path.

Attack Vector

The attack is network-based and requires no user interaction. An attacker must:

1. Obtain the target device's MAC address (via network scanning or physical label)
2. Obtain the service tag (from physical label, documentation, or social engineering)
3. Send authenticated HTTP requests to the hidden diagnostic endpoints
4. Execute arbitrary commands with root privileges

The vulnerability allows unauthenticated attackers who possess these two pieces of information to directly compromise the device without exploiting any memory corruption or complex exploitation chain. The diagnostic endpoints accept commands and execute them in the context of the root user.

Detection Methods for CVE-2026-41446

Indicators of Compromise

• Unexpected HTTP requests to non-standard or undocumented endpoints on WattBox devices
• Authentication attempts using MAC address and service tag combinations in HTTP parameters or headers
• Command execution logs showing unusual shell commands run as root
• Unexpected outbound network connections from WattBox devices to external IP addresses
• Modifications to device configuration files or firmware outside of normal maintenance windows

Detection Strategies

• Monitor network traffic for HTTP requests to WattBox devices from unauthorized source IP addresses
• Implement network segmentation to isolate IoT and power management devices from general user networks
• Deploy intrusion detection signatures to alert on exploitation attempts targeting WattBox diagnostic endpoints
• Review web server access logs on WattBox devices for access to undocumented URI paths

Monitoring Recommendations

• Enable logging on network firewalls and IDS/IPS systems for traffic to and from WattBox devices
• Conduct periodic firmware version audits to ensure all devices are patched to 2.10.0.0 or later
• Implement network behavior anomaly detection to identify unusual command-and-control patterns from IoT devices
• Maintain an asset inventory that tracks firmware versions and ensures timely patch deployment

How to Mitigate CVE-2026-41446

Immediate Actions Required

• Upgrade all Snap One WattBox 800 and 820 series devices to firmware version 2.10.0.0 or later immediately
• Isolate affected WattBox devices on a dedicated VLAN with strict access controls until patching is complete
• Restrict network access to WattBox devices to only authorized management stations
• Audit physical security to ensure device labels are not photographed or accessible to unauthorized personnel
• Review network logs for evidence of prior exploitation attempts

Patch Information

Snap One has released firmware version 2.10.0.0 that addresses this vulnerability. The firmware release notes and update instructions are available from the Snap One Firmware Release Notes. Organizations should prioritize immediate deployment of this update to all affected devices.

Workarounds

• Place WattBox devices behind a firewall that blocks inbound HTTP/HTTPS access from untrusted networks
• Implement network access control lists (ACLs) to restrict which IP addresses can communicate with WattBox devices
• Deploy a VPN or jump host requirement for remote management of power distribution equipment
• Physically obscure or remove device labels containing MAC address and service tag information where feasible
• Monitor for and block reconnaissance activities targeting IoT device endpoints