PT-2026-35820 · Snap One · Wattbox 800+1

Published 2026-04-28 · Updated 2026-04-30 · CVE-2026-41446

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Snap One WattBox 800 and 820 series versions prior to 2.10.0.0

Description Undisclosed diagnostic HTTP endpoints require only the device MAC address and service tag for authentication. Both values are printed in plaintext on the physical device label. An attacker with access to the device label or documentation containing these values can authenticate to several endpoints and execute arbitrary commands as root on the device.

Recommendations Update to firmware version 2.10.0.0.

Fix

RCE

Using Hardcoded Credentials

Hidden Functionality

Weakness Enumeration

CWE-798

CWE-912

Related Identifiers

CVE-2026-41446

Affected Products

Wattbox 800

Wattbox 820

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-41446 · Security Note
• https://help.snapone.com/wb-8x0-fw/Content/FW%20RN/8x0/8x0%20series%20FW%20RN.htm · Patch
• https://t.me/cveNotify/161585 · Telegram Post
• https://twitter.com/the_yellow_fall/status/2049474783012872386 · Twitter Post