Netman 204 - SQLi (CVE-2024-8877)

CVE-2024-8877 is a SQL injection vulnerability affecting Riello Netman 204, where improper handling of special characters in parameters allows attackers to craft malicious requests targeting measurement data stored in the SQLite database.

CrowdSec has been tracking this vulnerability and its exploits since 25th of March 2025.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2024-8877 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2024-8877 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2024-8877 is currently experiencing high visibility and active exploitation across the internet.

Attackers are observed probing URLs containing /cgi-bin/db_eventlog_w.cgi, attempting to inject malicious payloads via crafted parameter values.