The vulnerability in Voltronic Power SNMP Web Pro version 1.1 allows unauthenticated users to bypass authentication by modifying browser localStorage values. Attackers can change the client‑side authentication state that the server later trusts, thereby gaining access to privileged management functions without valid credentials. This defect is classified as CWE‑306: Missing Authentication.

Affected systems are installations of Voltronic Power SNMP Web Pro version 1.1. The product is a web‑based SNMP management console that uses localStorage to store authentication tokens. No other versions or vendors are listed as affected. Users running this version should verify their firmware and apply any updates if available.

The CVSS score of 8.8 indicates a high severity flaw, though the EPSS score of less than 1 % suggests limited exploitation in the wild. The vulnerability is not included in the CISA KEV catalog. An attacker can exploit the flaw by accessing the web interface from a browser and manipulating localStorage values, which the server blindly accepts. Once the state is altered, the attacker can call privileged API endpoints or perform sensitive actions normally restricted by authentication.