CVE-2025-13319

High

Published: 17 November 2025

Published

17 November 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0008 24.1th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-13319 is a high-severity Improper Input Validation (CWE-20) vulnerability in Nettec (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Databases (T1213.006); ranked at the 24.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Databases (T1213.006) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly requires validation of API inputs to block malicious SQL injection payloads before they reach the backend database.

SI-2 Flaw Remediation good match

prevent

Ensures timely remediation of the specific SQL injection flaw through patching as recommended in the vendor advisory.

SI-9 Information Input Restrictions partial match

prevent

Restricts API input length, types, or content to mitigate crafted SQL injection attempts.

MITRE ATT&CK Enterprise TechniquesAI

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

T1565.001 Stored Data Manipulation Impact

Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.

attack.mitre.org →

Why these techniques?

SQL injection enables arbitrary SQL queries for unauthorized database access and collection (T1213.006) and data modification/deletion (T1565.001).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

An injection vulnerability has been discovered in the API feature in Digi On-Prem Manager, enabling an attacker with valid API tokens to inject SQL via crafted input. The API is not enabled by default, and a valid API token is…

required to perform the attack.

Deeper analysisAI

CVE-2025-13319 is an SQL injection vulnerability (CWE-89, CWE-20) in the API feature of Digi On-Prem Manager. Published on 2025-11-17, it enables attackers to inject malicious SQL payloads through crafted input when interacting with the API. The vulnerability affects the Digi On-Prem Manager software, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts.

Exploitation requires network access and low privileges in the form of a valid API token, as the API is not enabled by default. An attacker with such a token can remotely submit crafted inputs to the API endpoints, executing arbitrary SQL queries against the backend database. This could lead to unauthorized data access, modification, or deletion, depending on the database permissions and structure.

The vendor security advisory DOM-25-001 at https://dom.nettec.no/security-advisories/DOM-25-001/ provides further details on the issue and recommended mitigations.