The Snap One WattBox 800 and 820 series firmware versions before 2.10.0.0 include undisclosed diagnostic HTTP endpoints that require only the device MAC address and service tag for authentication. Both authentication factors are easily obtainable from the device label. This design flaw (CWE-912 Hidden Functionality) allows an attacker with access to these values to authenticate and execute arbitrary commands with root privileges on the device. The vulnerability is remotely exploitable over the network without user interaction and has a high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to gain root-level command execution on affected devices, potentially leading to full compromise of the device. The vulnerability requires knowledge of the MAC address and service tag, which are publicly visible on the device label. This could lead to unauthorized control, data manipulation, or disruption of device operation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict physical access to devices to prevent attackers from obtaining the MAC address and service tag. Network-level protections such as firewall rules limiting access to device management interfaces may reduce exposure.