EUVD-2025-210079
GHSA-hpq5-cjqx-ppvm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify reachable NetMan 204 web port
-
DeliverySend unauthenticated GET to administration.html and configuration.html
-
ExploitHarvest LDAP credentials and user details
-
ExecutionPOST privileged command to administration-commands.html
-
PersistTrigger UPS shutdown or bypass switch
-
ImpactCause power loss to downstream infrastructure
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of the Riello NetMan 204 web management interface (administration.html, administration-commands.html, configuration.html). The only limiting factor is network reachability to the card's HTTP/HTTPS port: deployments where the NetMan 204 is isolated to a dedicated management VLAN or behind a firewall blocking inbound web traffic from untrusted segments substantially reduce attacker access, while internet-exposed or flat-network installations are exploitable as-is with no authentication, no user interaction, and no non-default settings required. |
| Impact | Multiple signals converge on high real-world risk. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H describes a network-reachable, low-complexity, no-prerequisite exploit with full confidentiality, integrity, and availability impact on the vulnerable component, and an Exploit-DB entry (52183) confirms publicly available exploit code exists. The vulnerability is not currently listed in CISA KEV, and EPSS data was not provided, so widespread opportunistic exploitation is not yet confirmed; however, the combination of a published PoC, trivial exploitation, and direct impact on power-availability of downstream equipment (data centers, industrial sites, medical facilities) makes this a priority patch. Exposure is gated by network reachability - NetMan 204 cards on properly segmented OT/management networks face lower immediate risk than internet-exposed or flat-network deployments. |
| Exploit ScenarioDerived | An attacker on a network with reachability to the NetMan 204 management IP issues a direct HTTP GET to /administration.html and /configuration.html to harvest LDAP bind credentials and the active user roster, then POSTs to /administration-commands.html to invoke the shutdown or switch-on-bypass command. The result is an immediate, attacker-controlled power event for every load downstream of the UPS - potentially crashing servers, network equipment, or industrial control systems - using the working proof of concept published on Exploit-DB (52183). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 05, 2026
Unauthenticated administrative access in Riello UPS NetMan 204 network management cards allows remote attackers to read sensitive configuration and invoke privileged power-control commands by requesting administrative pages directly. With CVSS 4.0 score 9.3, publicly available exploit code exists (Exploit-DB 52183), enabling attackers to trigger UPS shutdown, reboot, bypass-switching, and battery tests against the protected infrastructure without any credentials.
RemediationAI
Apply the firmware update available from Riello's download portal at https://www.riello-ups.com/downloads/25-netman-204 - an exact patched firmware version is not enumerated in the provided data, so administrators should consult the vendor page and the VulnCheck advisory (https://www.vulncheck.com/advisories/netman-204-missing-authentication-for-administrative-functions) for the fixed build number. Until patching is complete, restrict the NetMan 204 web management interface to a dedicated management VLAN or jump host using firewall ACLs (blocking inbound TCP/80 and TCP/443 from user, server, and internet networks); this preserves local administrative use but eliminates remote unauthenticated access. Additional compensating controls include placing the card behind an authenticating reverse proxy that enforces credentials before forwarding to administration*.html and configuration.html endpoints, and monitoring HTTP access logs for unauthenticated GETs to those paths, accepting that legitimate scripted integrations may need to be reconfigured to traverse the proxy.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The NetMan 204 is a network management card used to remotely monitor and control Riello uninterruptible power supplies over HTTP, SNMP, and Modbus. The flaw is a classic CWE-306 (Missing Authentication for Critical Function): administrative endpoints such as administration.html, administration-commands.html, and configuration.html are served by the embedded web interface without any session check, so the authentication layer that protects the login UI is not enforced on the underlying handlers. Because the same handlers expose LDAP credentials, user data, and UPS control primitives (shutdown, reboot, switch-on-bypass, battery test), an attacker who can reach the card's HTTP port effectively gains full administrative authority over the UPS.
Know when Netman 204 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
NetMan 204 fails to enforce authentication on its administrative pages and command endpoints. A remote, unauthenticated attacker can directly request administrative pages (such as administration.html, administration-commands.html, and configuration.html) to disclose sensitive information including LDAP configuration and active user details, and can invoke privileged UPS control commands - including shutdown, reboot, switch-on-bypass, and battery test - without supplying any credentials.
Executive ViewAI
Riello UPS NetMan 204 network management cards contain a critical vulnerability allowing unauthenticated remote attackers to execute privileged power control commands (shutdown, reboot, battery test) and read sensitive configuration without authentication. Publicly available exploit code exists; no vendor patch is currently available. This threatens operational continuity for any infrastructure relying on these UPS systems.
Network segmentation (dedicated VLAN or isolated management network), firewall ACLs restricting management interface access to authorized administrators only, disable remote management capabilities if operationally feasible, implement continuous monitoring and alerting for unauthorized access attempts, immediately change any default credentials, disable unused management services on affected units, conduct physical security review of UPS installations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
Exploit-DB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.