{"id":"CVE-2022-3372","aliases":["EUVD-2022-42751","GHSA-gjhf-g3gr-6f2m"],"status":"published","title":"Cross-Site Request Forgery (CSRF) in Riello UPS Netman-204","description":"There is a CSRF vulnerability on Netman-204 version 02.05. An attacker could manage to change administrator passwords through a Cross Site Request Forgery due to the lack of proper validation on the CRSF token. This vulnerability could allow a remote attacker to access the administrator panel, being able to modify different parameters that are critical for industrial operations.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.0035,"percentile":0.28902,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2023-06-21T12:47:01Z","modified":"2026-06-17T04:59:24Z","products":[{"vendor":"riello ups","product":"netman-204"},{"vendor":"riello-ups","product":"netman_204"},{"vendor":"riello-ups","product":"netman_204_firmware"}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso-sci/cross-site-request-forgery-csrf-riello-ups-netman-204","tags":["x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3372"},{"url":"https://github.com/advisories/GHSA-gjhf-g3gr-6f2m"}],"sources":{"cve":[{"id":"CVE-2022-3372","title":"Cross-Site Request Forgery (CSRF) in Riello UPS Netman-204","description":"There is a CSRF vulnerability on Netman-204 version 02.05. An attacker could manage to change administrator passwords through a Cross Site Request Forgery due to the lack of proper validation on the CRSF token. This vulnerability could allow a remote attacker to access the administrator panel, being able to modify different parameters that are critical for industrial operations.","status":"published","published":"2023-06-21T12:47:01.693Z","modified":"2024-12-06T21:18:40.398Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:34:33.24035Z"}],"euvd":[{"id":"EUVD-2022-42751","description":"There is a CSRF vulnerability on Netman-204 version 02.05. An attacker could manage to change administrator passwords through a Cross Site Request Forgery due to the lack of proper validation on the CRSF token. This vulnerability could allow a remote attacker to access the administrator panel, being able to modify different parameters that are critical for industrial operations.","status":"published","published":"2023-06-21T12:47:01Z","modified":"2024-12-06T21:18:40Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:04:38.652605Z"}],"ghsa":[{"id":"GHSA-gjhf-g3gr-6f2m","title":"There is a CSRF vulnerability on Netman-204 version 02.05. An attacker could manage to change...","description":"There is a CSRF vulnerability on Netman-204 version 02.05. An attacker could manage to change administrator passwords through a Cross Site Request Forgery due to the lack of proper validation on the CRSF token. This vulnerability could allow a remote attacker to access the administrator panel, being able to modify different parameters that are critical for industrial operations.","status":"published","published":"2023-06-21T15:30:20Z","modified":"2024-04-04T04:59:12Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:56:28.924331Z"}],"nvd":[{"id":"CVE-2022-3372","description":"There is a CSRF vulnerability on Netman-204 version 02.05. An attacker could manage to change administrator passwords through a Cross Site Request Forgery due to the lack of proper validation on the CRSF token. This vulnerability could allow a remote attacker to access the administrator panel, being able to modify different parameters that are critical for industrial operations.","status":"published","published":"2023-06-21T13:15:09.673Z","modified":"2026-06-17T04:59:24.337Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:07:38.721429Z"}]}}