CVE-2025-13510

9.3

Critical

Published:2 Dec 2025

Last updated:17 Jun 2026

Source:ics-cert@hq.dhs.gov

Deferred

Weakness (CWE)

CWE-306Missing Authentication for Critical Function

CVSS Vector

v4.0

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Confidentiality (Vulnerable): High
Integrity (Vulnerable): High
Availability (Vulnerable): High
Confidentiality (Subsequent): None
Integrity (Subsequent): None
Availability (Subsequent): None

View on MITRE Find PoC on GitHub

Description

The Iskra iHUB and iHUB Lite smart metering gateway exposes its web management interface without requiring authentication, allowing unauthenticated users to access and modify critical device settings.

References

ics-cert@hq.dhs.gov

https://www.cisa.gov/news-events/ics-advisories/icsa-25-336-02