{"id":48949,"date":"2026-09-02T16:48:49","date_gmt":"2026-09-02T11:18:49","guid":{"rendered":"https:\/\/www.getastra.com\/blog\/?p=48949"},"modified":"2026-09-02T16:48:52","modified_gmt":"2026-09-02T11:18:52","slug":"cve-2026-49481","status":"publish","type":"post","link":"https:\/\/www.getastra.com\/blog\/vulnerability\/cve-2026-49481\/","title":{"rendered":"CVE-2026-49481: Vulnerability in UpSnap"},"content":{"rendered":"
\n\n

Product Name:<\/strong> Package UpSnap<\/p>\n\n\n\n

Vulnerability:<\/strong>  Authenticated Remote Code Execution in UpSnap<\/p>\n\n\n\n

Vulnerable Version:<\/strong><= 5.3.5<\/p>\n\n\n\n

CVE:<\/strong> CVE-2026-49481<\/a><\/p>\n\n<\/div>\n\n\n

On 26\/05\/2026, a security researcher at Astra Security found a critical Remote Code Execution (RCE) vulnerability in UpSnap, a web-based wake-on-LAN(WoL). <\/p>\n\n\n\n

The root cause is an OS Command Injection vulnerability(CWE-78) that exists in UpSnap\u2019s device management functionality due to unsafe template interpolation of the IP and MAC fields. These templates are then executed via the system shell (\/bin\/sh -c on Linux or cmd \/C on Windows) without sanitization, escaping, or proper validation of dangerous characters (& ; | $() `). <\/p>\n\n\n\n

This results in an authenticated Remote Code Execution (RCE) vulnerability, allowing any low-privileged user with permission to create or edit devices to execute arbitrary operating system commands on the UpSnap server.<\/p>\n\n\n\n

<\/span>Technical Breakdown of CVE-2026-49481<\/span><\/h2>\n\n\n\n

CVE-2026-49481 was discovered during a manual security review of the device management and command execution functionality in UpSnap. This flaw allows authenticated attackers to achieve arbitrary remote code execution by injecting shell metacharacters into the IP or MAC fields, which are then interpreted by the shell when a Wake or Shutdown operation is triggered.<\/p>\n\n\n\n

How was CVE-2026-49481 discovered?<\/h3>\n\n\n\n

While reviewing the source code (specifically backend\/networking\/wake.go and shutdown.go), our researcher noticed:<\/p>\n\n\n\n

wake_cmd := device.GetString(\"wake_cmd\")\n\nwake_cmd = strings.ReplaceAll(wake_cmd, \"{{ DEVICE_IP }}\", device.GetString(\"ip\"))\n\n\/\/ ... similar for MAC\n\ncmd := exec.CommandContext(ctx, shell, shell_arg, wake_cmd)<\/code><\/pre>\n\n\n\n
To confirm the vulnerability was exploitable, the researcher set up a test device with a malicious IP address and a custom wake command:<\/p>\n\n\n\n
Wake Command: {{ DEVICE_IP }} (minimal test)\n\nIP Field: cmd.exe \/c whoami > C:\\Users\\Public\\rce_ip.txt (on Windows)<\/code><\/pre>\n\n\n\n
When the Wake button was clicked, UpSnap executed the injected command through the shell, successfully writing the output of whoami to the specified file. <\/p>\n\n\n\n
Further tests with payloads like & calc.exe, etc., confirmed reliable command injection. This process revealed a clear OS Command Injection vulnerability (CWE-78), leading to the responsible disclosure and this advisory.<\/p>\n\n\n\n
How to replicate the vulnerability CVE-2026-49481<\/h3>\n\n\n
\n\n
Prerequisites<\/strong><\/p>\n\n\n\n
    \n
  1. A running instance of UpSnap \u2264 5.3.5<\/strong> (Docker or direct install).<\/li>\n\n\n\n
  2. Valid credentials for an account that can create\/edit devices (authenticated access required).<\/li>\n\n\n\n
  3. Network access to the UpSnap web interface.<\/li>\n<\/ol>\n\n<\/div>\n\n\n
      \n
    1. Log in to the UpSnap web dashboard.<\/li>\n\n\n\n
    2. Create or edit a device:<\/li>\n\n\n\n
    3. Go to the Devices section.<\/li>\n\n\n\n
    4. Add a new device with the following values (example for Windows target using calc.exe):<\/li>\n<\/ol>\n\n\n\n
      Name: test-device\n\nIP: 127.0.0.1 & calc.exe \u2190 Injection point\n\nMAC: 00:11:22:33:44:55 (any valid-looking MAC)\n\nNetmask: 255.255.255.0\n\nOther fields as needed.<\/code><\/pre>\n\n\n\n
      5. In the device settings or global settings, set the Wake command to something like:<\/p>\n\n\n\n
      ping -n 1 {{ DEVICE_IP }}<\/code><\/pre>\n\n\n\n
      6. Click the Wake button for the device<\/p>\n\n\n\n
      7. On a Windows host running UpSnap, calc.exe should launch.<\/p>\n\n\n\n
      8. The calc.exe application launches successfully, confirming RCE.<\/p>\n\n\n\n
        <\/ol>\n\n\n\n
        Alternative minimal test (even stronger injection):<\/p>\n\n\n\n
        Set Wake command to just {{ DEVICE_IP }}\n\nSet IP to cmd.exe \/c whoami > C:\\Users\\Public\\rce.txt (Windows) or equivalent on Linux.<\/code><\/pre>\n\n\n\n
        <\/span>Impact of CVE-2026-49481<\/span><\/h2>\n\n\n\n
        A critical Remote Code Execution (RCE) vulnerability in UpSnap versions \u2264 5.3.5 allows authenticated attackers to achieve full server compromise by injecting arbitrary operating system commands.<\/p>\n\n\n\n
        The flaw resides in the template substitution logic within the wake and shutdown command execution paths (primarily backend\/networking\/wake.go and shutdown.go).<\/p>\n\n\n\n

        The vulnerability could lead to <\/p>\n\n\n\n