CVE-2025-71317

Vulnerability

NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants administrative access. A remote, unauthenticated attacker can authenticate through the cgi-bin/login.cgi endpoint. Due to lax parameter validation, the authentication can be performed with a shortened URL, such as /cgi-bin/login.cgi?username=eurek%20eurek [3]. The affected version is NetMan 204 [2].

Exploitation

An attacker can exploit this vulnerability by sending an HTTP request to the cgi-bin/login.cgi endpoint with the hard-coded credentials eurek for both username and password. The attacker does not require any authentication or network position restrictions, and can leverage lax parameter validation to shorten the request URL. For example, an attacker can use /cgi-bin/login.cgi?username=eurek%20eurek to gain administrator privileges [2, 3].

Impact

Successful exploitation grants an attacker administrative privileges on the NetMan 204 device. This allows the attacker to alter the device configuration, enable potentially insecure services like Telnet or SSH, and reset local user credentials. This could lead to a full compromise of the device and its connected systems [3].

Mitigation

Fixed versions and release dates are not yet disclosed in the available references. There are no workarounds mentioned. NetMan 204 is listed as a product by RPS S.p.a. [1].