The NetMan 204 device from Riello UPS fails to require authentication on its administrative interfaces, including pages like administration.html, administration-commands.html, and configuration.html. This lack of access control permits remote attackers without any credentials to retrieve sensitive configuration and user information and to perform critical UPS control operations remotely. The vulnerability is rated critical with a CVSS 4.0 score of 9.3 due to its network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

An unauthenticated remote attacker can obtain sensitive information such as LDAP configuration and active user details, potentially aiding further attacks. More critically, the attacker can execute privileged commands on the UPS device, including shutdown, reboot, switching to bypass mode, and initiating battery tests. These actions can disrupt power management and availability, leading to potential operational outages or damage to connected equipment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the NetMan 204 administrative interfaces to trusted users only, for example by network segmentation or firewall rules. Monitor for unauthorized access attempts and consider disabling remote management if feasible.