Is CVE-2025-71317 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-71317 being exploited in the wild.

How severe is CVE-2025-71317?

Critical severity, with a CVSS score of 9.8, published 5 June 2026.

Which products and versions are affected?

Riello UPS NetMan 204 All versions including 2.04.

Is there a fix for CVE-2025-71317?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-71317 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2025-71317?

Check whether you run Riello UPS NetMan 204 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-71317: Riello UPS NetMan 204 hard-coded backdoor credentials

CVE-2025-71317 · Severity: critical · CVSS 9.8 · Published 2026-06-05

The NetMan 204 is a network card used to manage and monitor Uninterruptible Power Supply (UPS) systems. A security flaw has been identified where the device contains a built-in 'backdoor' account with a permanent, unchangeable password. An attacker can use these credentials to remotely take full control of the power management system, potentially allowing them to shut down connected servers, change security settings, or disrupt critical power infrastructure.

Vendors: Riello UPS.

Quick answers

Is CVE-2025-71317 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-71317 being exploited in the wild.
How severe is CVE-2025-71317?: Critical severity, with a CVSS score of 9.8, published 5 June 2026.
Which products and versions are affected?: Riello UPS NetMan 204 All versions including 2.04.
Is there a fix for CVE-2025-71317?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-71317 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2025-71317?: Check whether you run Riello UPS NetMan 204 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The NetMan 204 firmware contains hard-coded administrative credentials (CWE-798) within the authentication logic. A remote, unauthenticated attacker can gain full administrative access by sending a specially crafted request to the /cgi-bin/login.cgi endpoint using the 'eurek' username and password. Due to lax parameter validation in the login script, the authentication can also be triggered using a shortened URL format (e.g., /cgi-bin/login.cgi?username=eurek%20eurek). Successful exploitation allows for complete device takeover, including the ability to modify system configurations, enable remote management services like SSH or Telnet, and manipulate connected UPS hardware. No patch has been officially confirmed in the advisory, though users are advised to restrict network access to these management interfaces.

Affected products

Riello UPS NetMan 204 All versions including 2.04

Timeline

2025-02-04: other: Vulnerability discovered by researcher
2025-04-11: disclosed: Exploit details published on Exploit-DB
2026-06-05: advisory: CVE published and NVD record created

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.