CRITICAL

CVE-2026-49481

UpSnap vulnerable to Remote Code Execution via IP Field Template Injection in wake_cmd/shutdown_cmd

CVSS v3

9.6

CRITICAL

EPSS Score

1.5 %

exploit probability, as of 2026-09-27

CISA KEV

known exploited

Exploitation

—

SSVC status

Description

UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s device management functionality due to the presence of unsafe shell command template interpolation using the ip and the mac fields. User-controlled values can be inserted into the wake_cmd and shutdown_cmd templates and executed via /bin/sh -c (Linux) or cmd /C (Windows) without sanitization, resulting in an authenticated Remote Code Execution (RCE). A low-privileged user with perm

Technical details

Published: 2026-08-12
Last Modified: 2026-08-13

Frequently asked questions

What is CVE-2026-49481?

Is CVE-2026-49481 actively exploited?

Active exploitation of CVE-2026-49481 has not been confirmed. Its EPSS score was 1.5% on 2026-09-27, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2026-49481?

CVE-2026-49481 has a CVSS v3 base score of 9.6 (CRITICAL severity).

Is CVE-2026-49481 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.

Check an IP Search CVEs SIEM & TIP integrations

No credit card required · 500 free checks/month · Free API key

Other 2026 vulnerabilities worth triaging

Ranked by exploit probability (EPSS).

Back to CVE Database