Riello NetMan 208 CVE-2025-68914

Requires network reachability to the Riello NetMan 208 UPS card's web management interface and the ability to send a request to the cgi-bin/login.cgi endpoint; the injectable parameter is the 'username' field on the login form, so no authentication or user interaction is needed (PR:N/UI:N). Exploitation is limited to deployments running NetMan 208 Application before version 1.12, and realistic exposure depends on whether the UPS management interface is network-accessible to the attacker (these cards are often on management/OT segments rather than the public internet), which is the primary limiting factor rather than any special feature toggle.

This is a genuine but moderate-priority issue rather than a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates a network-reachable, low-complexity, unauthenticated flaw, which is the most attacker-favorable access profile. Exploitation status is 'publicly available exploit code exists' (POC on GitHub) but there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of active or widespread exploitation - the POC signal and the absence of KEV together point toward opportunistic/targeted rather than mass exploitation. The scored impact is deliberately narrow (C:N/I:L/A:N - integrity-only, e.g. deleting LOGINFAILEDTABLE), which keeps the base score at 5.3 (Medium) despite the easy access. Note a tension worth flagging: the demonstrated behavior is table deletion (an integrity/availability effect), yet SQL injection at a login endpoint typically also permits authentication bypass or credential/data exfiltration, which the official C:N rating does not capture - verify the real data-access impact against the referenced research. No SSVC decision data was supplied. Overall: real and easy to trigger, but limited blast radius in a low-prevalence embedded management product.

A remote, unauthenticated attacker reaches the web management interface of a Riello NetMan 208 UPS card and submits a crafted 'username' value to cgi-bin/login.cgi that injects SQL into the backend query. Because exploitation needs no credentials or user interaction (AV:N/AC:L/PR:N/UI:N), the attacker can manipulate the database - for example dropping the LOGINFAILEDTABLE - and public POC code for this vulnerability chain already exists, lowering the skill barrier.