CVE-2025-68916

The cgi-bin/certsupload.cgi endpoint does not properly sanitize the uploaded file path, accepting the /../ sequence (path traversal). An attacker can upload an executable file outside the allowed directory — for example, to a location from which the device operating system automatically executes it. As a result, the uploaded payload can be interpreted as code by the CGI server, resulting in remote code execution (RCE) on the device.

An attacker can gain full control over the NetMan 208 device, including reading and modifying its configuration, installing malicious software, and potentially affecting managed UPS backup power supplies. The vulnerability enables breach of confidentiality, integrity, and availability of the system (C:H, I:H, A:H).

The Riello UPS NetMan 208 Application software should be updated to version 1.12 or later. Details are available in the manufacturer's references and in the repository: https://github.com/gerico-lab/riello-multiple-vulnerabilities-2025. Until the patch is applied, it is recommended to limit network access to the device management interface (e.g., through a firewall or dedicated management network).

Riello UPS NetMan 208 Application in versions prior to 1.12.