CVE-2025-13506

HighUpdated

Published: 12 December 2025

Published

12 December 2025

Modified

04 June 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0009 25.5th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-13506 is a high-severity Execution with Unnecessary Privileges (CWE-250) vulnerability in Gov (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 25.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and AC-3 (Access Enforcement).

Deeper analysis

CVE-2025-13506 is an Execution with Unnecessary Privileges vulnerability (CWE-250) in Nebim V3 ERP, a product of Nebim Neyir Computer Industry and Services Inc. The issue enables expanding control over the operating system from the database layer. It affects Nebim V3 ERP versions starting from 2.0.59 up to but not including 3.0.1, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

The vulnerability can be exploited by an attacker with low privileges over the network, requiring low attack complexity and no user interaction. Successful exploitation allows the attacker to achieve high impacts across confidentiality, integrity, and availability, effectively granting unnecessary elevated privileges to execute arbitrary code and expand control from the database to the full operating system.

The advisory at https://www.usom.gov.tr/bildirim/tr-25-0450 provides further details on the issue. Mitigation requires upgrading to Nebim V3 ERP version 3.0.1 or later, as the vulnerability is fixed in that release.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-203080

Vulnerability details

Execution with Unnecessary Privileges vulnerability in Nebim Neyir Computer Industry and Services Inc. Nebim V3 ERP allows Expanding Control over the Operating System from the Database. This issue affects Nebim V3 ERP: from 2.0.59 before 3.0.1.

CWE(s): CWE-250

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

The vulnerability is explicitly an Execution with Unnecessary Privileges issue (CWE-250) allowing low-privileged network attackers to execute arbitrary code and escalate to full OS control from the database layer, directly mapping to Exploitation for Privilege Escalation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0