CVE-2024-8878

The vulnerability (CWE-640) results from improper implementation of the password recovery mechanism. An attacker can use the password reset procedure in such a way as to set a new administrator password without the need to verify identity. Network access to the device's network is the only necessary condition to carry out the attack — no prior credentials or user interaction are required.

The attacker gains full administrative control over the Riello Netman 204 device, which enables changing its configuration, disrupting UPS operation, and potentially cutting off power to critical infrastructure.

Apply patches available from the manufacturer according to the references provided. Until updates are applied, it is recommended to isolate Netman 204 devices from public networks and restrict access to the management interface exclusively to trusted hosts through firewall or network segmentation.

Riello Netman 204 (firmware) in all versions up to and including 4.05.