Authentication Bypass in Snap One WattBox 800 and 820 Series

CVE-2026-41446

What is CVE-2026-41446?

The Snap One WattBox 800 and 820 series firmware versions before 2.10.0.0 contain hidden diagnostic HTTP endpoints that can be accessed with minimal authentication. These endpoints only require the device's MAC address and service tag for access, both of which are readily available on the physical device label. This creates a significant security risk, as attackers who can obtain this information may execute arbitrary commands as root, compromising the device's integrity and security.

References