CVE-2025-13319 Authenticated SQL injection in API - Digi On-Prem Manager
Authenticated attackers with valid API tokens can inject SQL into the Digi On-Prem Manager API, potentially reading or modifying data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-13319?
CVE-2025-13319 is a high-severity SQL injection vulnerability in Nettec AS Digi On-Prem Manager, published on 17 Nov 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An injection vulnerability has been discovered in the API feature in Digi On-Prem Manager, enabling an attacker with valid API tokens to inject SQL via crafted input.
The API is not enabled by default, and a valid API token is required to perform the attack.
Which versions are affected by CVE-2025-13319?
How do I fix CVE-2025-13319?
No fix has been published for CVE-2025-13319 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2025-13319 being exploited?
There is no known exploitation of CVE-2025-13319 in the wild and no public exploit code.
Sources
Also known as GHSA-wj43-cgxg-gm76.