CVE-2024-8877: Riello Netman 204 SQL injection in measurement data database

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

medium priorityThe flaw is remotely exploitable without authentication but is limited to a measurement database with low confidentiality and integrity impact and no known in-the-wild exploitation.

What it is

Riello Netman 204 firmware through 4.05 fails to neutralize special elements, allowing SQL injection into the SQLite database that stores measurement data. The flaw is remotely reachable without authentication, so an exposed device can be queried or manipulated by anyone who can reach its interface.

Impact

An attacker can read and modify the measurement data stored in the device's SQLite database, which may allow falsified readings or limited data tampering. The CVSS vector rates confidentiality and integrity impact as low and availability impact as none.

Attack surface

The CVSS 4.0 vector is network-based with no privileges and no user interaction required, so the injection is reachable directly over the network. The description does not state which endpoint or parameter is vulnerable, so the exact entry point is unknown.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented. EPSS is high at 0.77265 (99.5th percentile), but the references are only a vendor advisory and a Full Disclosure post, with no public exploit code or in-the-wild reporting confirmed.

What to do

• Upgrade Netman 204 firmware beyond 4.05 to a version that fixes the SQL injection.
• If patching is not possible, restrict network access to the device to trusted management hosts only.
• Place the device behind a firewall or VPN and avoid exposing its web interface to the internet.
• Review the vendor advisory and Full Disclosure post for any additional workarounds or indicators.
• Monitor the SQLite measurement database for unexpected changes or corruption.

Detection

• Inspect HTTP requests to the Netman 204 interface for SQL metacharacters such as quotes, UNION, or comment sequences.
• Alert on unexpected changes to the measurement data database or anomalous query patterns.
• Baseline normal device traffic and flag new or unusual source IPs reaching the management interface.
• Check device logs for repeated failed or malformed requests that could indicate injection probing.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.