CVE-2025-71318

Name of the Vulnerable Software and Affected Versions NetMan 204 (affected versions not specified)

Description Authentication is not enforced on administrative pages and command endpoints. A remote, unauthenticated attacker can directly request pages such as 'administration.html', 'administration-commands.html', and 'configuration.html' to disclose sensitive information, including LDAP configuration and active user details. Additionally, privileged UPS control commands, such as shutdown, reboot, switch-on-bypass, and battery test, can be invoked without credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.