PT-2025-48770 · Iskra · Ihub+1

Souvik Kandar · Published 2025-12-02 · Updated 2026-01-09 · CVE-2025-13510

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Iskra iHUB and iHUB Lite (affected versions not specified)

Description The Iskra iHUB and iHUB Lite smart metering gateway’s web management interface is accessible without authentication. This allows unauthenticated users to access and modify critical device settings. The gateway exposes its admin panel with no authentication required, potentially enabling network pivoting into critical infrastructure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2025-13510

Affected Products

Ihub

Ihub Lite

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-13510 · Security Note
• https://twitter.com/CVEnew/status/1995943879913115776 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-25-336-02 · Note
• https://twitter.com/VulmonFeeds/status/1996111355917521013 · Twitter Post
• https://t.me/CVEtracker/38714 · Telegram Post
• https://t.me/pentestingnews/71373 · Telegram Post
• https://twitter.com/PurpleOps_io/status/1996097211701113322 · Twitter Post
• https://reddit.com/r/secithubcommunity/comments/1pd0t5o/critical_alert_iskra_ihub_devices_exposed_to · Reddit Post
• https://twitter.com/0dayPublishing/status/1995941092219298174 · Twitter Post
• https://twitter.com/cyber_sec_raj/status/1997396558514393447 · Twitter Post
• https://twitter.com/Komodosec/status/2009460176416637280 · Twitter Post
• https://twitter.com/syedaquib77/status/1996822203526963666 · Twitter Post