CVE-2024-8877

CVE-2024-8877 is an unauthenticated SQL injection (CWE-89) in the Riello Netman 204 UPS network management card, affecting all firmware versions through 4.05. Per the CVSS 4.0 vector, it is reachable remotely over the network with no privileges or user interaction required, apparently by sending crafted requests to the card's management interface. The flaw is confined to the SQLite database that stores measurement data, so an attacker can read or tamper with that stored data (low confidentiality and integrity impact) without taking over the device or disrupting power availability. Any deployment running Netman 204 firmware 4.05 or earlier is affected, which spans a broad installed base of Riello UPS installations. No public proof-of-concept or confirmed in-the-wild exploitation is known and the flaw is not in CISA KEV, but EPSS assigns a 77.3% probability of exploitation within 30 days (100th percentile), making prompt patching and exposure checks advisable.

What to do: Upgrade Netman 204 to a fixed firmware newer than 4.05 following Riello's advisory, since this data does not name a specific fixed version. Until patched, restrict access to the card's management interface (avoid direct internet exposure or port forwarding) and review device logs for unusual requests. Given the very high EPSS score, prioritize checking and patching internet-exposed devices first.