Netman 208
Monthly
Authenticated remote code execution affects the Riello UPS NetMan 208 Application before version 1.12, where the cgi-bin/certsupload.cgi certificate-upload handler fails to neutralize '/../' directory-traversal sequences in the supplied path, allowing a file to be written outside the intended certificate directory and subsequently executed. Exploitation requires valid high-privilege credentials on the network-reachable web management interface (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so the practical exposure is limited to environments where such credentials exist, such as shared technician logins or reused defaults. Publicly available exploit code exists (published in the gerico-lab GitHub advisory set), but there is no CISA KEV confirmation of active exploitation, making this a moderate-but-real risk rather than a top-tier emergency.
Stored cross-site scripting in Riello UPS NetMan 208 application versions before 1.12 allows an authenticated high-privilege attacker to inject a crafted banner via cgi-bin/loginbanner_w.cgi; the payload later executes in the browser of a victim who loads the affected login page. Publicly available exploit code exists, but no CISA KEV active exploitation is indicated, and the requirement for administrative write access plus victim interaction limits real-world risk. The vulnerability is rated CVSS 4.8.
SQL injection in the Riello NetMan 208 UPS network management card's web login endpoint (cgi-bin/login.cgi) lets remote unauthenticated attackers inject arbitrary SQL through the username field of the login form, with enough impact to delete backend tables such as LOGINFAILEDTABLE. The flaw affects NetMan 208 Application versions before 1.12 and requires only network reachability to the card's web management interface - no credentials or user interaction are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). Publicly available exploit code exists via a GitHub advisory repository; no confirmed active exploitation (CISA KEV) was observed at time of analysis, and the practical risk is dominated by whether these UPS management cards are exposed beyond isolated management/OT segments.
Authenticated remote code execution affects the Riello UPS NetMan 208 Application before version 1.12, where the cgi-bin/certsupload.cgi certificate-upload handler fails to neutralize '/../' directory-traversal sequences in the supplied path, allowing a file to be written outside the intended certificate directory and subsequently executed. Exploitation requires valid high-privilege credentials on the network-reachable web management interface (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so the practical exposure is limited to environments where such credentials exist, such as shared technician logins or reused defaults. Publicly available exploit code exists (published in the gerico-lab GitHub advisory set), but there is no CISA KEV confirmation of active exploitation, making this a moderate-but-real risk rather than a top-tier emergency.
Stored cross-site scripting in Riello UPS NetMan 208 application versions before 1.12 allows an authenticated high-privilege attacker to inject a crafted banner via cgi-bin/loginbanner_w.cgi; the payload later executes in the browser of a victim who loads the affected login page. Publicly available exploit code exists, but no CISA KEV active exploitation is indicated, and the requirement for administrative write access plus victim interaction limits real-world risk. The vulnerability is rated CVSS 4.8.
SQL injection in the Riello NetMan 208 UPS network management card's web login endpoint (cgi-bin/login.cgi) lets remote unauthenticated attackers inject arbitrary SQL through the username field of the login form, with enough impact to delete backend tables such as LOGINFAILEDTABLE. The flaw affects NetMan 208 Application versions before 1.12 and requires only network reachability to the card's web management interface - no credentials or user interaction are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). Publicly available exploit code exists via a GitHub advisory repository; no confirmed active exploitation (CISA KEV) was observed at time of analysis, and the practical risk is dominated by whether these UPS management cards are exposed beyond isolated management/OT segments.