CVE-2025-71317
published 2026-06-05CVE-2025-71317: NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants administrative access. A remote, unauthenticated attacker…
PriorityP267critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.43%
34.5th percentile
NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants administrative access. A remote, unauthenticated attacker can authenticate through the cgi-bin/login.cgi endpoint (for example /cgi-bin/login.cgi?username=eurek&password=eurek, which due to lax parameter validation can be shortened to /cgi-bin/login.cgi?username=eurek%20eurek) to obtain administrator privileges, allowing them to alter device configuration, enable the telnet/SSH services, and reset local user credentials.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| riello_ups | netman_204 | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Riello UPS NetMan up to 204 SSH Service cgi-bin/login.cgi hard-coded credentials (Exploit 52183 / EDB-52183)
vuldb·2026-06-05·CVSS 9.3
CVE-2025-71317 [CRITICAL] Riello UPS NetMan up to 204 SSH Service cgi-bin/login.cgi hard-coded credentials (Exploit 52183 / EDB-52183)
A vulnerability was found in Riello UPS NetMan up to 204. It has been rated as critical. Affected by this issue is some unknown functionality of the file cgi-bin/login.cgi of the component SSH Service. The manipulation leads to hard-coded credentials.
This vulnerability is listed as CVE-2025-71317. The attack may be initiated remotely. In addition, an exploit is available.
GHSA
NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants administrative access.
ghsa_unreviewed·2026-06-05
CVE-2025-71317 [CRITICAL] CWE-798 NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants administrative access.
NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants administrative access. A remote, unauthenticated attacker can authenticate through the cgi-bin/login.cgi endpoint (for example /cgi-bin/login.cgi?username=eurek&password=eurek, which due to lax parameter validation can be shortened to /cgi-bin/login.cgi?username=eurek%20eurek) to obtain administrator privileges, allowing them to alter device configuration, enable the telnet/SSH services, and reset local user credentials.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-05
Published