CVE-2026-49481

Name of the Vulnerable Software and Affected Versions UpSnap versions prior to 5.4.0

Description An OS command injection flaw exists in the device management functionality. This occurs due to unsafe shell command template interpolation using the ip and mac fields. An authenticated low-privileged user with permissions to create or edit devices can insert controlled values into the wake cmd and shutdown cmd templates. These values are executed via /bin/sh -c on Linux or cmd /C on Windows without proper sanitization, leading to Remote Code Execution (RCE) on the hosted server.

Recommendations Update to version 5.4.0.