CVE-2022-47891

2023-10-0312:15:09

CWE-798

[email protected]

web.nvd.nist.gov

cve-2022-47891

netman 204

administrator password

recovery function

mac address

serial number

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.2

Confidence

High

EPSS

0.001

Percentile

25.5%

JSON

All versions of NetMan 204 allow an attacker that knows the MAC and serial number of the device to reset the administrator password via the legitimate recovery function.

Affected configurations

Nvd

Node

riello-upsnetman_204Match-

AND

riello-upsnetman_204_firmware

VendorProductVersionCPE
riello-upsnetman_204-cpe:2.3:h:riello-ups:netman_204:-:*:*:*:*:*:*:*
riello-upsnetman_204_firmware*cpe:2.3:o:riello-ups:netman_204_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
riello-ups	netman_204	-	cpe:2.3:h:riello-ups:netman_204:-:::::::*
riello-ups	netman_204_firmware	*	cpe:2.3:o:riello-ups:netman_204_firmware::::::::