What is the CVSS score of CVE-2025-13510?

CVE-2025-13510 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2025-13510?

Within 24 hours: Identify all Iskra iHUB and iHUB Lite devices in your environment and isolate them from untrusted networks; document affected asset inventory. Within 7 days: Implement network segmentation to restrict web interface access to authorized administrative networks only; enable network monitoring for suspicious access patterns. Within 30 days: Contact Iskra for patch availability and deployment timeline; evaluate device replacement options; conduct forensic audit of device logs for unauthorized access or configuration changes.

CVE-2025-13510

EUVD-2025-200298 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2025-12-02 ics-cert@hq.dhs.gov

Authentication Bypass

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 14:04 euvd

EUVD-2025-200298

Analysis Generated

Mar 15, 2026 - 14:04 vuln.today

CVE Published

Dec 02, 2025 - 20:15 nvd

CRITICAL 9.3

DescriptionCVE.org

The Iskra iHUB and iHUB Lite smart metering gateway exposes its web management interface without requiring authentication, allowing unauthenticated users to access and modify critical device settings.

Analysis

Technical ContextAI

An authentication bypass vulnerability allows attackers to circumvent login mechanisms and gain unauthorized access without valid credentials. This vulnerability is classified as Missing Authentication for Critical Function (CWE-306).

RemediationAI

Implement robust authentication mechanisms. Use multi-factor authentication. Review authentication logic for bypass conditions. Remove default credentials.