CVE-2025-13319

High

Published: 17 November 2025

Published

17 November 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0008 24.3th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-13319 is a high-severity Improper Input Validation (CWE-20) vulnerability in Nettec (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Databases (T1213.006); ranked at the 24.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-13319 is an SQL injection vulnerability (CWE-89, CWE-20) in the API feature of Digi On-Prem Manager. Published on 2025-11-17, it enables attackers to inject malicious SQL payloads through crafted input when interacting with the API. The vulnerability affects the Digi On-Prem Manager software, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts.

Exploitation requires network access and low privileges in the form of a valid API token, as the API is not enabled by default. An attacker with such a token can remotely submit crafted inputs to the API endpoints, executing arbitrary SQL queries against the backend database. This could lead to unauthorized data access, modification, or deletion, depending on the database permissions and structure.

The vendor security advisory DOM-25-001 at https://dom.nettec.no/security-advisories/DOM-25-001/ provides further details on the issue and recommended mitigations.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-197807

Vulnerability details

An injection vulnerability has been discovered in the API feature in Digi On-Prem Manager, enabling an attacker with valid API tokens to inject SQL via crafted input. The API is not enabled by default, and a valid API token is…

required to perform the attack.

CWE(s): CWE-20 CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

T1565.001 Stored Data Manipulation Impact

Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.

attack.mitre.org →

Why these techniques?

SQL injection enables arbitrary SQL queries for unauthorized database access and collection (T1213.006) and data modification/deletion (T1565.001).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0