CVE-2025-13319: Nettec As Digi On-Prem Manager

High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days.

An injection vulnerability has been discovered in the API feature in Digi On-Prem Manager, enabling an attacker with valid API tokens to inject SQL via crafted input. The API is not enabled by default, and a valid API token is required to perform the attack.

Affected products

• Nettec As Digi On-Prem Manager: from 24.12.5, before 25.08.5 (fixed in 25.08.5)

Published 2025-11-17. Last modified 2026-10-07.