Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2025-13319

Authenticated SQL injection in API - Digi On-Prem Manager

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Digi

Description

An injection vulnerability has been discovered in the API feature in Digi On-Prem Manager, enabling an attacker with valid API tokens to inject SQL via crafted input. The API is not enabled by default, and a valid API token is required to perform the attack.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Nettec AS Digi On-Prem Manager

Default version status: unaffected

  • 24.12.5 to < 25.08.5affected

References