CVE-2025-71318— RIELLO UPS NetMan 访问控制错误漏洞

NetMan 204 Missing Authentication for Administrative Functions

NetMan 204 fails to enforce authentication on its administrative pages and command endpoints. A remote, unauthenticated attacker can directly request administrative pages (such as administration.html, administration-commands.html, and configuration.html) to disclose sensitive information including LDAP configuration and active user details, and can invoke privileged UPS control commands — including shutdown, reboot, switch-on-bypass, and battery test — without supplying any credentials.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

关键功能的认证机制缺失

RIELLO UPS NetMan 访问控制错误漏洞

RIELLO UPS NetMan是意大利RIELLO UPS公司的一款网络适配器。 RIELLO UPS NetMan 204存在访问控制错误漏洞，该漏洞源于未对管理页面和命令端点实施身份验证，未经身份验证的远程攻击者可直接请求管理页面，泄露敏感信息，并调用特权UPS控制命令。

N/A

N/A