PT-2026-47014 · Riello Ups · Netman 204

Published 2026-06-05 · Updated 2026-06-05 · CVE-2025-71318

Mitre

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NetMan 204 fails to enforce authentication on its administrative pages and command endpoints. A remote, unauthenticated attacker can directly request administrative pages (such as administration.html, administration-commands.html, and configuration.html) to disclose sensitive information including LDAP configuration and active user details, and can invoke privileged UPS control commands — including shutdown, reboot, switch-on-bypass, and battery test — without supplying any credentials.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2025-71318

Affected Products

Netman 204

References · 4

• 🔥 https://exploit-db.com/exploits/52183 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-71318 · Security Note
• https://vulncheck.com/advisories/netman-204-missing-authentication-for-administrative-functions · Note
• https://riello-ups.com/downloads/25-netman-204 · Note