Description
An injection vulnerability has been discovered in the API feature in Digi On-Prem Manager, enabling an attacker with valid API tokens to inject SQL via crafted input.

The API is not enabled by default, and a valid API token is required to perform the attack.
Published: 2025-11-17
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 18 Nov 2025 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Nettec
Nettec digi On-prem Manager
Vendors & Products Nettec
Nettec digi On-prem Manager

Mon, 17 Nov 2025 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 17 Nov 2025 16:45:00 +0000

Type Values Removed Values Added
Description An injection vulnerability has been discovered in the API feature in Digi On-Prem Manager, enabling an attacker with valid API tokens to inject SQL via crafted input. The API is not enabled by default, and a valid API token is required to perform the attack.
Title Authenticated SQL injection in API - Digi On-Prem Manager
Weaknesses CWE-20
CWE-89
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Nettec Digi On-prem Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: Digi

Published:

Updated: 2025-11-17T16:46:47.902Z

Reserved: 2025-11-17T15:24:52.019Z

Link: CVE-2025-13319

cve-icon Vulnrichment

Updated: 2025-11-17T16:45:37.610Z

cve-icon NVD

Status : Deferred

Published: 2025-11-17T17:15:48.550

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-13319

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2025-11-18T09:06:08Z

Weaknesses