Read the docs

Riello UPS

Records12All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical6CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

Riello UPS records in CISA KEV

No Riello UPS vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Netman 204 Firmware 7 records HIGH Netman 208 3 records HIGH

Records

12 records

TI-2024-08244 CVE-2024-8878 · GHSA-52jr-7fqr-h29h

Unauthenticated Password Reset

Priority HIGH 82

The password recovery mechanism for the forgotten password in Riello Netman 204 allows an attacker to reset the admin password and take over control of the device.This issue affects Netman 204: through 4.05.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.01265 Published 2024-09-24 No fix listed CWE-640
TI-2025-43438 CVE-2025-71317 · GHSA-w87w-x2c9-f3pw

NetMan 204 Hard-coded Backdoor Credentials

Priority HIGH 81

NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants administrative access.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00432 Published 2026-06-05 No fix listed CWE-798
TI-2024-08243 CVE-2024-8877 · GHSA-8g8m-p65c-g42p

SQL injection in Riello UPS Netman 204

Priority HIGH 78

Improper neutralization of special elements results in a SQL Injection vulnerability in Riello Netman 204.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.77265 Published 2024-09-24 No fix listed CWE-89
TI-2025-42374 CVE-2025-68916 · GHSA-m8vh-pfcv-5mp2

Path traversal in Riello UPS NetMan

Priority HIGH 74

Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/certsupload.cgi /../ directory traversal for file upload with resultant code execution.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.02618 Published 2025-12-24 Fixed in 208 1.12 CWE-25
TI-2025-42372 CVE-2025-68914 · GHSA-c2rc-wwm8-hc57

SQL injection in Riello UPS NetMan

Priority HIGH 68

Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/login.cgi username SQL Injection.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00223 Published 2025-12-24 Fixed in 208 1.12 CWE-89
TI-2022-23729 CVE-2022-47893 · GHSA-xp8c-vfh9-64v5

NetMan 204 Remote Code Execution

Priority MEDIUM 51

There is a remote code execution vulnerability that affects all versions of NetMan 204.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01178 Published 2023-10-03 No fix listed CWE-434
TI-2022-23728 CVE-2022-47892 · GHSA-c8xr-gf3v-574p

Information disclosure in NetMan 204

Priority LOW 39

All versions of NetMan 204 could allow an unauthenticated remote attacker to read a file (config.cgi) containing sensitive information, like credentials.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00478 Published 2023-10-03 No fix listed CWE-200
TI-2022-23727 CVE-2022-47891 · GHSA-2jmg-wxp9-5qfc

Admin password reset in NetMan 204

Priority LOW 39

All versions of NetMan 204 allow an attacker that knows the MAC and serial number of the device to reset the administrator password via the legitimate recovery function.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00613 Published 2023-10-03 No fix listed CWE-798
Open these records in search →