CVE-2025-71317

Name of the Vulnerable Software and Affected Versions NetMan version 204

Description NetMan contains a hard-coded backdoor account with the username and password eurek that provides administrative access. A remote, unauthenticated attacker can authenticate through the "/cgi-bin/login.cgi" endpoint using the username and password parameters to obtain administrator privileges. Due to lax parameter validation, the authentication request can be simplified. Once authenticated, an attacker can modify device configurations, enable telnet or SSH services, and reset local user credentials.

Recommendations Update NetMan version 204 to a newer version that removes the hard-coded backdoor account.