A hard‑coded backdoor account with the username and password 'eurek' allows an unauthenticated attacker to authenticate through the NetMan 204 CGI login endpoint, giving full administrative control over the device. The attacker can then modify configuration files, enable telnet/SSH services, and reset local user credentials, effectively taking over the device with minimal effort.

All installations of Riello UPS NetMan 204 firmware are vulnerable. No specific sub‑versions are listed, so all released versions of NetMan 204 are affected.

The CVSS score of 9.3 indicates a critical level of risk. The EPSS score is not provided, and the vulnerability is not yet listed in the CISA KEV catalog, but its nature—remote unauthenticated access via a predictable CGI endpoint—means it can be exploited as soon as the device is reachable over the network. The lack of input validation on the login script allows attackers to use a simple HTTP request to gain privilege escalation.