PT-2025-47166 · Digi · Digi On-Prem Manager

Published 2025-11-17 · Updated 2025-11-17 · CVE-2025-13319

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Digi On-Prem Manager (affected versions not specified)

Description An injection flaw exists in the API feature of Digi On-Prem Manager. An attacker with valid API tokens can inject SQL code via crafted input. The API is not enabled by default. The vulnerability allows for potential database compromise through the injection of malicious SQL.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

RCE

Weakness Enumeration

CWE-89

CWE-20

Related Identifiers

CVE-2025-13319

Affected Products

Digi On-Prem Manager

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-13319 · Security Note
• https://dom.nettec.no/security-advisories/DOM-25-001 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1990539155974082903 · Twitter Post
• https://twitter.com/CVEnew/status/1990462679882830199 · Twitter Post
• https://twitter.com/CveFindCom/status/1990505328408961457 · Twitter Post
• https://twitter.com/CveTodo/status/1990474637076054275 · Twitter Post
• https://t.me/CVEtracker/37515 · Telegram Post