CVE-2025-68914
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/login.cgi username SQL Injection. For example, an attacker can delete the LOGINFAILEDTABLE table.
Risk Assessment
An attacker can gain unauthorized access to the database, modify or delete data, potentially leading to system integrity compromise or service disruption.
Recommendation
Update Riello UPS NetMan 208 to version 1.12 or later if a patch is available. Additionally, restrict access to the management interface to trusted networks.
Other vulnerabilities in Riello UPS NetMan 208
See all- CVE-2025-68916Critical
Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/certsupload.cgi /../ directory traversal for file upload with resultant code execution.
- CVE-2025-68915Medium
XSS vulnerability in Riello UPS NetMan 208 before 1.12, present in cgi-bin/loginbanner_w.cgi via a crafted banner.
Original NVD description (English source)
Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/login.cgi username SQL Injection. For example, an attacker can delete the LOGINFAILEDTABLE table.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS