NetMan 208 CVE-2025-68915

Exploitation requires the attacker to already possess high-privilege (administrative) access to the NetMan 208 web application in order to write the login banner through cgi-bin/loginbanner_w.cgi - this matches PR:H in the CVSS vector and is the primary gating condition. Execution additionally depends on a victim subsequently loading the affected login page (UI:R), so the payload is stored but not self-triggering. Affected deployments are NetMan 208 application versions before 1.12; upgrading to 1.12 is the stated remediation boundary. These factors - required privileged write access plus victim interaction - substantially limit realistic exploitation compared to the network attack vector alone.

This is a stored cross-site scripting (CWE-79) flaw in the Riello UPS NetMan 208 management application, and the signals point to genuinely modest real-world risk despite the network attack vector. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, base 4.8 Medium) shows the decisive limiting factor: PR:H means an attacker must already hold high-privilege (administrative) access to write the login banner, and UI:R means a victim must subsequently load the affected page for the injected script to fire. The scope change (S:C) and Low confidentiality/integrity impacts reflect script execution in the victim's browser session rather than direct system compromise. No EPSS score, KEV entry, or SSVC decision data was provided, so exploitation-probability and automatability signals are simply unavailable rather than low. Publicly available exploit code exists (gerico-lab GitHub advisory), which modestly raises practical exploitability, but POC availability is not active exploitation and must not be conflated with it. Net: a privileged-attacker, user-interaction-dependent stored XSS in a niche UPS network-management card - a real but low-priority issue, not a high-urgency network-unauthenticated threat.

An attacker who already holds administrative access to the NetMan 208 web interface submits a crafted login banner through cgi-bin/loginbanner_w.cgi containing malicious JavaScript. The payload is stored and later executes in the browser of any user (such as another administrator) who loads the login page, enabling session/credential theft or UI manipulation within that user's context. Public exploit code for this and related Riello vulnerabilities is available, lowering the effort to reproduce.