NetMan 204 fails to enforce authentication on its administrative pages and command endpoints. A remote, unauthenticated attacker can directly request administrative pages such as administration.html, administration-commands.html, and configuration.html to disclose sensitive information including LDAP configuration and active user details, and can invoke privileged UPS control commands — including shutdown, reboot, switch-on-bypass, and battery test — without supplying any credentials. The root weakness is the absence of authentication controls (CWE‑306).

The vulnerability affects Riello UPS NetMan 204 firmware devices. All firmware versions of NetMan 204 are potentially impacted, as the firmware lacked authentication on administrative pages and command endpoints.

The CVSS score of 9.3 indicates a high severity vulnerability that could provide an attacker with full administrative control over the UPS device. EPSS is not available, so the likelihood of exploitation remains unknown. An attacker can send simple HTTP requests to the NetMan 204 administration interface, access pages such as administration.html and configuration.html, retrieve LDAP configuration and active user details, and issue privileged UPS commands without authentication. An exploit-db entry demonstrates that this flaw can be leveraged in practice. The vulnerability is not listed in the CISA KEV catalog.