Riello Ups Netman 204 vulnerabilities

CVE-2025-71318 [CRITICAL] CWE-306 CVE-2025-71318: NetMan 204 fails to enforce authentication on its administrative pages and command endpoints. A remo NetMan 204 fails to enforce authentication on its administrative pages and command endpoints. A remote, unauthenticated attacker can directly request administrative pages (such as administration.html, administration-commands.html, and configuration.html) to disclose sensitive information including LDAP configuration and active user details, and ca

CVE-2025-71317 [CRITICAL] CWE-798 CVE-2025-71317: NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants administrative access. A remote, unauthenticated attacker can authenticate through the cgi-bin/login.cgi endpoint (for example /cgi-bin/login.cgi?username=eurek&password=eurek, which due to lax parameter validation can be shortened to /cgi-bin/logi