CVE-2026-41446 describes a critical vulnerability in Snap One WattBox 800 and 820 series devices running firmware versions before 2.10.0.0. The devices contain undisclosed diagnostic HTTP endpoints that require only the device MAC address and service tag for authentication. Since both values are printed in plaintext on the physical device label, an attacker with access to the label or documentation can authenticate to these endpoints and execute arbitrary commands with root privileges. This represents a hidden functionality issue categorized under CWE-912. No official patch or remediation level has been provided as of the publication date.

An attacker who obtains the MAC address and service tag from the device label can gain root-level command execution on the affected WattBox devices. This could lead to full device compromise, unauthorized control, and potential disruption of device functionality. The vulnerability has a critical severity with a CVSS 4.0 score of 9.2, indicating high impact and ease of exploitation given network access and physical or documented access to the device identifiers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict physical access to the device labels and any documentation containing the MAC address and service tag. Limit network access to the device's HTTP management interfaces to trusted administrators only. Monitor vendor communications for updates on patches or official mitigations.