Snap One WattBox 800 and 820 Series Undisclosed Diagnostic HTTP Endpoint Vulnerability Allowing Root Command Execution

A vulnerability exists in Snap One WattBox 800 and 820 series firmware versions prior to 2.10.0.0. It involves undisclosed diagnostic HTTP endpoints that authenticate using the device MAC address and service tag, both of which are visible on the physical device label. Attackers with access to these values can authenticate to the endpoints and execute arbitrary commands as root on the device.

Impact

Exploitation of this vulnerability allows authenticated users to execute arbitrary commands as root on the affected WattBox device.

Remediation

Users can update to Snap One WattBox firmware version 2.10.0.0 or later to address this vulnerability.