TI-2025-12182 Aliases CVE-2025-13319 GHSA-wj43-cgxg-gm76

Authenticated SQL injection in API - Digi On-Prem Manager

MEDIUM 40CWE-20Published 2025-11-17 · Updated 2025-11-17

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

An injection vulnerability has been discovered in the API feature in Digi On-Prem Manager, enabling an attacker with valid API tokens to inject SQL via crafted input. The API is not enabled by default, and a valid API token is required to perform the attack.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00452 39th percentileScored 2026-11-07

Fix Fixed Digi On-Prem Manager (Nettec AS): 25.08.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Nettec AS	Digi On-Prem Manager	24.12.5 to before 25.08.5	25.08.5	Patch available	CNA

Digi On-Prem Manager VendorNettec AS Affected 24.12.5 to before 25.08.5 Fixed in 25.08.5 Patch available CNA

Remediation

Fix · CNA Digi On-Prem Manager (Nettec AS) Fixed in 25.08.5

Timeline

2026-10-02 Threatist record created from CVE-2025-13319
2026-10-03 Alias added: GHSA-wj43-cgxg-gm76

References

Advisory 1

https://dom.nettec.no/security-advisories/DOM-25-001/

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences