Riello Ups Netman-204 vulnerabilities

CVE-2022-47893 [CRITICAL] CWE-434 CVE-2022-47893: There is a remote code execution vulnerability that affects all versions of NetMan 204. A remote att There is a remote code execution vulnerability that affects all versions of NetMan 204. A remote attacker could upload a firmware file containing a webshell, that could allow him to execute arbitrary code as root.

CVE-2022-47891 [HIGH] CWE-798 CVE-2022-47891: All versions of NetMan 204 allow an attacker that knows the MAC and serial number of the device to r All versions of NetMan 204 allow an attacker that knows the MAC and serial number of the device to reset the administrator password via the legitimate recovery function.

CVE-2022-47892 [HIGH] CWE-200 CVE-2022-47892: All versions of NetMan 204 could allow an unauthenticated remote attacker to read a file (config.cgi All versions of NetMan 204 could allow an unauthenticated remote attacker to read a file (config.cgi) containing sensitive information, like credentials.

CVE-2022-3372 [HIGH] CWE-352 CVE-2022-3372: There is a CSRF vulnerability on Netman-204 version 02.05. An attacker could manage to change admini There is a CSRF vulnerability on Netman-204 version 02.05. An attacker could manage to change administrator passwords through a Cross Site Request Forgery due to the lack of proper validation on the CRSF token. This vulnerability could allow a remote attacker to access the administrator panel, being able to modify different parameters that are critical