Voltronic Power SNMP Web Pro 1.1 Authenticatie omzeiling via localStorage

The impact of this vulnerability is severe. An attacker can completely bypass authentication and gain full administrative control over the SNMP Web Pro device. This could lead to unauthorized configuration changes, data breaches (potentially including sensitive network information), and even complete device takeover. The ability to manipulate browser localStorage to circumvent authentication represents a significant security risk, as it bypasses standard security measures. Successful exploitation could allow an attacker to modify device settings, disrupt network operations, or exfiltrate sensitive data, potentially impacting the entire network infrastructure relying on the SNMP Web Pro device.

Organizations utilizing Voltronic Power SNMP Web Pro for network management, particularly those with exposed management interfaces or those lacking robust network segmentation, are at significant risk. Shared hosting environments where multiple users share the same SNMP Web Pro instance are also particularly vulnerable, as an attacker could potentially compromise the entire environment.

• linux / server:

journalctl -u snmpwebpro | grep -i "localStorage"

• generic web:

curl -I <snmpwebpro_url> | grep -i "localStorage"

1. 2026-03-13Disclosure

   disclosure

1. Gereserveerd2026-01-06
2. Gepubliceerd2026-03-13
3. Gewijzigd2026-04-22
4. EPSS bijgewerkt2026-03-23

The primary mitigation is to immediately upgrade Voltronic Power SNMP Web Pro to version 7.6.47 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting access to the SNMP Web Pro interface from untrusted networks. Implement strict network segmentation to limit the potential blast radius of a successful attack. Monitor browser traffic for unusual localStorage modifications. While a WAF may not directly prevent this type of attack, it can be configured to detect and block suspicious requests based on known attack patterns. After upgrading, confirm the fix by attempting to access management functions without valid credentials and verifying that access is denied.