Riello NetMan 208 CVE-2025-68916

Exploitation requires authenticated administrative access (PR:H) to the Riello UPS NetMan 208 web management interface and the ability to reach the cgi-bin/certsupload.cgi certificate-upload endpoint over the network. The specific trigger is supplying '/../' directory-traversal sequences in the upload path to write a file outside the intended certificate directory, which is then executed. Limiting factors: the attacker must already possess valid high-privilege credentials, the vulnerable version is the NetMan 208 Application before 1.12 (patched in 1.12), and the device/management interface must be network-reachable from the attacker. No user interaction is required (UI:N).

This is a moderate-but-real risk rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, base 7.2 HIGH) shows a network-reachable, low-complexity flaw that results in full compromise (C:H/I:H/A:H), but it is explicitly gated behind PR:H - the attacker must already hold high (administrative) privileges on the NetMan 208 management interface. A publicly available exploit exists (POC=YES in input), which raises practical risk and lowers the barrier for an attacker who has already obtained or guessed admin credentials, but the vulnerability is NOT in CISA KEV and no EPSS score was supplied, so there is no evidence of active, widespread exploitation at this time. The dominant signals are therefore in tension: high impact and public POC pull risk up, while the PR:H authentication requirement and absence of KEV/EPSS data pull real-world urgency down. Net assessment: prioritize for authenticated/managed UPS appliances exposed to untrusted networks, but it is not a drive-by internet worm candidate. EPSS and SSVC decision data were not provided and could not be factored in - verify against current EPSS before final triage.

An attacker with administrative access to the NetMan 208 web management interface sends a crafted multipart upload to cgi-bin/certsupload.cgi containing '/../' sequences in the path, writing an attacker-controlled file outside the intended certificate directory. Because the written file can land in an executable/served location, this yields arbitrary code execution on the UPS management card. A public proof-of-concept for this and related Riello vulnerabilities is already published, reducing the effort required to reproduce the attack.