CVE-2025-68915
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
XSS vulnerability in Riello UPS NetMan 208 before 1.12, present in cgi-bin/loginbanner_w.cgi via a crafted banner.
Risk Assessment
An attacker can inject malicious script into the login page, potentially leading to session hijacking of administrators or other users.
Recommendation
Update NetMan 208 software to version 1.12 or later to fix the vulnerability.
Other vulnerabilities in Riello UPS NetMan 208
See all- CVE-2025-68916Critical
Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/certsupload.cgi /../ directory traversal for file upload with resultant code execution.
- CVE-2025-68914Medium
Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/login.cgi username SQL Injection. For example, an attacker can delete the LOGINFAILEDTABLE table.
Original NVD description (English source)
Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/loginbanner_w.cgi XSS via a crafted banner.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS