The Riello UPS NetMan 204 device fails to enforce authentication on its administrative interfaces, including pages like administration.html, administration-commands.html, and configuration.html. This lack of authentication enables a remote, unauthenticated attacker to retrieve sensitive information such as LDAP configuration and active user details. Additionally, the attacker can invoke critical UPS control commands—shutdown, reboot, switch-on-bypass, and battery test—without providing any credentials. The vulnerability is rated critical with a CVSS 4.0 score of 9.3, reflecting its network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published by the vendor as of the provided data.

An unauthenticated remote attacker can gain access to sensitive administrative information and execute critical control commands on the UPS device, potentially disrupting power management and causing operational outages. The confidentiality, integrity, and availability of the UPS system are all severely impacted. This could lead to unauthorized shutdowns, reboots, or other disruptive actions on the UPS, affecting dependent infrastructure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, consider restricting network access to the NetMan 204 administrative interfaces to trusted hosts only and implement network-level controls to limit exposure.