Netman 204 Firmware
Approved changes feed: RSS · Atom
cpe:2.3:o:riello-ups:netman_204_firmware:-:*:*:*:*:*:*:*
part: o version: - update: *
| Vendor | Riello Ups (df9b499e-b533-5028-996a-fd8a69ff161b) |
|---|---|
| Product | Netman 204 Firmware (ec748d0d-9af6-5a15-a36c-a74897ae47ff) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-71318 |
vulnerable | 2026-06-08 07:43:17.878195 |
NetMan 204 Missing Authentication for Administrative Functions
CRITICAL (9.8)
NetMan 204 fails to enforce authentication on its administrative pages and command endpoints. A remote, unauthenticated attacker can directly request administrative pages (such as administration.html, administration-commands.html, and configuration.html) to disclose sensitive information including LDAP configuration and active user details, and can invoke privileged UPS control commands — including shutdown, reboot, switch-on-bypass, and battery test — without supplying any credentials.
Published: 2026-06-05T17:49:51.355Z
Updated: 2026-06-08T16:14:03.898Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-71317 |
vulnerable | 2026-06-08 07:43:17.876648 |
NetMan 204 Hard-coded Backdoor Credentials
CRITICAL (9.8)
NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants administrative access. A remote, unauthenticated attacker can authenticate through the cgi-bin/login.cgi endpoint (for example /cgi-bin/login.cgi?username=eurek&password=eurek, which due to lax parameter validation can be shortened to /cgi-bin/login.cgi?username=eurek%20eurek) to obtain administrator privileges, allowing them to alter device configuration, enable the telnet/SSH services, and reset local user credentials.
Published: 2026-06-05T17:49:50.474Z
Updated: 2026-06-05T19:35:30.991Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.