Vulnerability · Published Jun 5, 2026 · Assigned by VulnCheck

CVE-2025-71318NetMan 204 Missing Authentication for Administrative Functions

Critical 9.8

In plain English

A critical-severity missing authentication in NetMan 204 from Riello UPS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.5%top 54.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

NetMan 204 fails to enforce authentication on its administrative pages and command endpoints. A remote, unauthenticated attacker can directly request administrative pages (such as administration.html, administration-commands.html, and configuration.html) to disclose sensitive information including LDAP configuration and active user details, and can invoke privileged UPS control commands — including shutdown, reboot, switch-on-bypass, and battery test — without supplying any credentials.

Affected products (as reported)

Vendor	Product	Versions
Riello UPS	NetMan 204	0

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Exploit-DB exploit
Vendor product
VulnCheck Advisory: NetMan 204 Missing Authentication for Administrative Functions third-party-advisory