CVE-2025-13319 - Vulnerability Details - OpenCVE

An injection vulnerability has been discovered in the API feature in Digi On-Prem Manager, enabling an attacker with valid API tokens to inject SQL via crafted input.

The API is not enabled by default, and a valid API token is required to perform the attack.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://dom.nettec.no/security-advisories/DOM-25-001/

History

Mon, 17 Nov 2025 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 17 Nov 2025 16:45:00 +0000

Type	Values Removed	Values Added
Description		An injection vulnerability has been discovered in the API feature in Digi On-Prem Manager, enabling an attacker with valid API tokens to inject SQL via crafted input. The API is not enabled by default, and a valid API token is required to perform the attack.
Title		Authenticated SQL injection in API - Digi On-Prem Manager
Weaknesses		CWE-20 CWE-89
References		https://dom.nettec.no/security-advisories/DOM-25-001/
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: Digi

Published: 2025-11-17T16:37:40.377Z

Updated: 2025-11-17T16:46:47.902Z

Reserved: 2025-11-17T15:24:52.019Z

Link: CVE-2025-13319

Vulnrichment

Updated: 2025-11-17T16:45:37.610Z

NVD

Status : Received

Published: 2025-11-17T17:15:48.550

Modified: 2025-11-17T17:15:48.550

Link: CVE-2025-13319

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13319", "assignerOrgId": "e8a6bb0b-e373-42b1-a5de-93e314325576", "state": "PUBLISHED", "assignerShortName": "Digi", "dateReserved": "2025-11-17T15:24:52.019Z", "datePublished": "2025-11-17T16:37:40.377Z", "dateUpdated": "2025-11-17T16:46:47.902Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "Digi On-Prem Manager", "vendor": "Nettec AS", "versions": [{"lessThan": "25.08.5", "status": "affected", "version": "24.12.5", "versionType": "custom"}]}], "datePublic": "2025-11-17T15:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>An injection vulnerability has been discovered in the API feature in Digi On-Prem Manager, enabling an attacker with valid API tokens to inject SQL via crafted input.</p><p>The API is not enabled by default, and a valid API token is required to perform the attack.</p>"}], "value": "An injection vulnerability has been discovered in the API feature in Digi On-Prem Manager, enabling an attacker with valid API tokens to inject SQL via crafted input.\n\nThe API is not enabled by default, and a valid API token is required to perform the attack."}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "e8a6bb0b-e373-42b1-a5de-93e314325576", "shortName": "Digi", "dateUpdated": "2025-11-17T16:39:45.998Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://dom.nettec.no/security-advisories/DOM-25-001/"}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2025-11-14T16:30:00.000Z", "value": "Vulnerability discovered"}, {"lang": "en", "time": "2025-11-17T15:30:00.000Z", "value": "Fixed version released"}], "title": "Authenticated SQL injection in API - Digi On-Prem Manager", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-17T16:46:16.389834Z", "id": "CVE-2025-13319", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-17T16:46:47.902Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13319", "assignerOrgId": "e8a6bb0b-e373-42b1-a5de-93e314325576", "state": "PUBLISHED", "assignerShortName": "Digi", "dateReserved": "2025-11-17T15:24:52.019Z", "datePublished": "2025-11-17T16:37:40.377Z", "dateUpdated": "2025-11-17T16:46:47.902Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "Digi On-Prem Manager", "vendor": "Nettec AS", "versions": [{"lessThan": "25.08.5", "status": "affected", "version": "24.12.5", "versionType": "custom"}]}], "datePublic": "2025-11-17T15:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>An injection vulnerability has been discovered in the API feature in Digi On-Prem Manager, enabling an attacker with valid API tokens to inject SQL via crafted input.</p><p>The API is not enabled by default, and a valid API token is required to perform the attack.</p>"}], "value": "An injection vulnerability has been discovered in the API feature in Digi On-Prem Manager, enabling an attacker with valid API tokens to inject SQL via crafted input.\n\nThe API is not enabled by default, and a valid API token is required to perform the attack."}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "e8a6bb0b-e373-42b1-a5de-93e314325576", "shortName": "Digi", "dateUpdated": "2025-11-17T16:39:45.998Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://dom.nettec.no/security-advisories/DOM-25-001/"}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2025-11-14T16:30:00.000Z", "value": "Vulnerability discovered"}, {"lang": "en", "time": "2025-11-17T15:30:00.000Z", "value": "Fixed version released"}], "title": "Authenticated SQL injection in API - Digi On-Prem Manager", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13319", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-17T16:46:16.389834Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-17T16:45:37.610Z"}}]}}