CVE-2025-68915
📋 TL;DR
This vulnerability allows cross-site scripting (XSS) attacks through the login banner functionality in Riello UPS NetMan 208 Application. Attackers can inject malicious scripts that execute in users' browsers when they view the login banner. Organizations using vulnerable versions of this UPS management software are affected.
💻 Affected Systems
- Riello UPS NetMan 208 Application
📦 What is this software?
Netman 208 by Riello Ups
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, hijack sessions, or redirect users to malicious sites, potentially gaining full control of the UPS management system.
Likely Case
Attackers could perform session hijacking or credential theft against administrators accessing the web interface.
If Mitigated
With proper network segmentation and access controls, impact is limited to the UPS management interface only.
🎯 Exploit Status
XSS vulnerabilities are commonly weaponized and require minimal technical skill to exploit
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.12 or later
Vendor Advisory: https://github.com/gerico-lab/riello-multiple-vulnerabilities-2025
Restart Required: Yes
Instructions:
1. Download latest firmware from Riello website. 2. Backup current configuration. 3. Apply firmware update via web interface. 4. Restart the UPS management module.
🔧 Temporary Workarounds
Disable web interface access
allTemporarily disable web management interface access until patching
Configure firewall to block access to port 80/443 on UPS management IP
Input validation via reverse proxy
allDeploy a reverse proxy with input sanitization for the login banner endpoint
Configure WAF or reverse proxy to sanitize requests to /cgi-bin/loginbanner_w.cgi
🧯 If You Can't Patch
- Isolate UPS management network segment from user networks
- Implement strict access controls allowing only trusted administrators to access the web interface
🔍 How to Verify
Check if Vulnerable:
Check web interface version at login page or via SNMP query to UPS management moduleCheck Version:
curl -s http://<ups-ip>/ | grep -i 'netman.*version'Verify Fix Applied:
Verify version is 1.12 or higher and test XSS payloads no longer execute📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /cgi-bin/loginbanner_w.cgi
- JavaScript payloads in URL parameters
Network Indicators:
- HTTP requests containing script tags or JavaScript in login banner parameters
SIEM Query:
source="ups-web-logs" AND (uri="/cgi-bin/loginbanner_w.cgi" AND (param="script" OR param="javascript"))