EUVD-2025-210078
GHSA-w87w-x2c9-f3pw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessScan for NetMan 204 web UI
-
DeliverySend GET to /cgi-bin/login.cgi with eurek/eurek
-
ExploitReceive administrator session
-
ExecutionEnable telnet/SSH services
-
PersistReset legitimate user credentials
-
ImpactAlter UPS configuration or pivot inward
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Credential externalization
MITRE ATT&CK
2 techniques across 2 tactics: Persistence, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The vulnerable cgi-bin/login.cgi endpoint of the NetMan 204 management interface must be reachable from the attacker's network position - typically TCP HTTP/HTTPS on the management IP of the UPS card. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no authentication, no user interaction, and no special attack requirements are needed, and the backdoor 'eurek' account exists in default firmware shipping configuration rather than a customer-enabled feature. The only practical limiting factor is network exposure of the NetMan 204 web UI: deployments where the card is isolated on a non-routable management VLAN are not remotely exploitable, while any internet- or corporate-LAN-exposed NetMan 204 is exploitable against default configurations. |
| Impact | All signals converge on high real-world risk. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H confirms remote, unauthenticated, low-complexity exploitation yielding full confidentiality, integrity, and availability impact on the vulnerable component. Publicly available exploit code (Exploit-DB 52183) further lowers the barrier - any opportunistic actor scanning for the login.cgi endpoint can weaponize this with a single HTTP request. EPSS and CISA KEV status are not provided in the input data, so widespread active exploitation cannot be confirmed at time of analysis; however, hard-coded credentials in internet-exposed UPS management interfaces have a strong historical pattern of being incorporated into botnet and ICS-targeting scans. SSVC-style decision: exploitation is presumed (POC public), automatable (single HTTP GET), and technical impact is total - this is a real, high-priority issue, not a high-CVSS-but-low-real-risk paper finding. |
| Exploit ScenarioDerived | An attacker scanning the internet for Riello NetMan 204 management interfaces issues a single HTTP GET to /cgi-bin/login.cgi?username=eurek&password=eurek (or the shortened /cgi-bin/login.cgi?username=eurek%20eurek variant) and obtains an authenticated administrative session. From there they enable telnet/SSH, reset legitimate operator credentials to lock out defenders, and either alter UPS shutdown thresholds to disrupt downstream loads or use the device as a foothold on the OT/management network. Public POC code from Exploit-DB entry 52183 means no novel research is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 05, 2026
Remote unauthenticated administrative access to Riello UPS NetMan 204 devices is possible via a hard-coded backdoor account ('eurek'/'eurek') exposed through the cgi-bin/login.cgi endpoint. The flaw (CWE-798) carries a CVSS 4.0 base of 9.3 and publicly available exploit code exists (Exploit-DB 52183, VulnCheck advisory), enabling full takeover of UPS management functions including configuration changes and enabling telnet/SSH. No public exploit identified at time of analysis as actively exploited in CISA KEV, but the trivially abusable static credential makes opportunistic exploitation highly likely.
RemediationAI
No vendor-released patched version is independently confirmed in the available data; defenders should monitor the Riello downloads portal at https://www.riello-ups.com/downloads/25-netman-204 for an updated NetMan 204 firmware that removes the 'eurek' account and review the VulnCheck advisory at https://www.vulncheck.com/advisories/netman-204-hard-coded-backdoor-credentials for any vendor coordination updates. Until a fix is installed, immediately remove the NetMan 204 web management interface from internet exposure by placing it behind a management VLAN or firewall ACL restricting access to known administrative source IPs, which trades remote convenience for safety. Disable any port-forwarding rules to the device, and where the device supports it disable telnet/SSH services so that an attacker who does authenticate via the backdoor cannot easily pivot to interactive shells; this reduces post-compromise utility but does not block the configuration-tampering paths through the web UI itself. Monitor web logs for requests to /cgi-bin/login.cgi containing the string 'eurek' as a high-fidelity indicator of exploitation attempts.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NetMan 204 is a network management card produced by Riello UPS for remote monitoring and control of uninterruptible power supplies, commonly deployed in data centers, industrial environments, and critical-infrastructure power distribution. The vulnerability is rooted in CWE-798 (Use of Hard-coded Credentials): the firmware ships with an undocumented administrator account whose username and password are both 'eurek', validated through the cgi-bin/login.cgi web interface. A secondary parsing weakness in the CGI handler treats a single space-delimited query parameter ('username=eurek%20eurek') equivalently to separate username and password parameters, demonstrating lax input parsing on top of the credential issue. CPE coverage (cpe:2.3:a:riello_ups:netman_204:*) indicates all firmware versions of the NetMan 204 card are presently in scope.
Know when Netman 204 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants administrative access. A remote, unauthenticated attacker can authenticate through the cgi-bin/login.cgi endpoint (for example /cgi-bin/login.cgi?username=eurek&password=eurek, which due to lax parameter validation can be shortened to /cgi-bin/login.cgi?username=eurek%20eurek) to obtain administrator privileges, allowing them to alter device configuration, enable the telnet/SSH services, and reset local user credentials.
Executive ViewAI
Riello UPS NetMan 204 devices are vulnerable to complete unauthorized takeover through a trivial hard-coded administrative backdoor account, with publicly available exploit code creating immediate risk to critical backup power infrastructure. Organizations deploying these devices face potential loss of UPS functionality, configuration tampering, and persistent remote access-directly threatening operational continuity. The absence of a vendor patch makes this an urgent infrastructure risk that requires immediate defensive action.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Reset hard-coded 'eurek' account to unique credentials; (2) Restrict cgi-bin/login.cgi endpoint via firewall or network ACLs; (3) Isolate NetMan 204 management traffic to a dedicated, air-gapped administrative network; (4) Disable remote protocols (telnet, SSH) unless operationally required; (5) Implement continuous monitoring and alerting for login attempts to the management interface. These controls significantly reduce exploitation risk but do not eliminate it pending device replacement or vendor patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
Exploit-DB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.