EUVD-2026-26142Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no account (AV:N/PR:N), but AC:H because the attacker must obtain the per-device MAC and service tag; root command execution yields full C:H/I:H/A:H.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
5DescriptionCVE.org
Snap One WattBox 800 and 820 series firmware versions prior to 2.10.0.0 contain undisclosed diagnostic HTTP endpoints that require only the device MAC address and service tag for authentication, both of which are printed in plaintext on the physical device label. Attackers with access to the device label or documentation containing these values can authenticate to the several endpoints and execute arbitrary commands as root on the device.
AnalysisAI
Root command execution on Snap One WattBox 800 and 820 series power-management devices running firmware before 2.10.0.0 is possible through undisclosed diagnostic HTTP endpoints whose only authentication is the device MAC address and service tag - values printed in plaintext on the unit's physical label. Anyone who can read the label, or documentation/photos containing those values, can authenticate and run arbitrary commands as root. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list; EPSS is low at 0.07%.
Technical ContextAI
WattBox 800/820 are IP-connected outlet/power-distribution controllers commonly installed in custom AV and smart-building deployments, managed over an HTTP interface. The root cause maps to CWE-798 (Use of Hard-coded Credentials): the diagnostic endpoints treat two static, device-embossed identifiers - the MAC address and the factory service tag - as an authentication secret. Because neither value is secret in any meaningful sense (the MAC is broadcast on the local network and the service tag is printed on the chassis label), the scheme functions as an authentication bypass rather than a credential check, and the endpoints grant OS-level command execution as root. CVSS 4.0 CPE/vector data confirms network reach (AV:N) with a present attack requirement (AT:P) reflecting the need to know the label values.
RemediationAI
Vendor-released patch: firmware 2.10.0.0 - upgrade all WattBox 800 and 820 units to 2.10.0.0 or later, consulting the Snap One release notes at https://help.snapone.com/wb-8x0-fw/Content/FW%20RN/8x0/8x0%20series%20FW%20RN.htm. Until every device is updated, restrict network reachability of the HTTP management interface to a dedicated management VLAN or trusted admin hosts so the diagnostic endpoints cannot be reached from general or guest networks (trade-off: legitimate remote management must move to that restricted path). Because the 'credentials' are the physical MAC and service tag, also control physical and documentary exposure: avoid publishing rack photos, asset spreadsheets, or support tickets that list device MAC/service-tag values, and treat those identifiers as sensitive (trade-off: inventory and support workflows that rely on those tags need adjustment). Do not expose these devices directly to the internet.
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today