Riello NetMan 204: unauthenticated admin pages allow UPS shutdown and config disclosure

CVSS 9.3CVE-2025-71318Firmware, BMC & network fabriccurated

Impact

The NetMan 204 is the network card that puts a Riello UPS on the management network. Any unauthenticated request to its administrative pages returns configuration data, including LDAP settings and active user details, and the same unauthenticated path can invoke privileged UPS control commands - shutdown, reboot, switch-to-bypass and battery test. On a GPU floor that means an attacker who reaches the facilities VLAN can drop power to whatever the UPS feeds, or push it onto bypass so the next utility event is unprotected; a hard power loss on a rack of accelerators is a worst-case drain event, not a graceful one. The disclosed LDAP configuration also hands over directory details that are usually reused elsewhere in the management network.

Who can reach it

Anyone with network reach to the UPS management card's web interface - typically the facilities or management VLAN. No authentication and no credentials of any kind are required.

What to do

Treat this as firmware on an in-band facilities device: check the Riello NetMan 204 download page for a release that enforces authentication on the administrative pages and flash the card. Until then the only reliable control is network: remove the card from any routable segment, restrict it to a jump host ACL, and confirm no UPS management interface answers from tenant or general corporate networks. The record does not name a fixed version, so verify with the vendor before planning the flash window. Flashing the card does not interrupt the UPS load path, but schedule it alongside other facilities work since the card is the only remote shutdown control while it reboots.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-71318 https://www.riello-ups.com/downloads/25-netman-204 https://www.vulncheck.com/advisories/netman-204-missing-authentication-for-administrative-functions

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.