What is the CVSS score of CVE-2025-13658?

CVE-2025-13658 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.1%.

Which versions of Longwatch are affected by CVE-2025-13658?

A critical vulnerability in Longwatch devices permits unauthenticated attackers to execute arbitrary code with system-level privileges through simple HTTP requests, potentially compromising all…

How to fix or mitigate CVE-2025-13658?

Within 24 hours: Inventory all Longwatch devices in the environment and assess network exposure; isolate any internet-facing instances from production networks. Within 7 days: Implement network segmentation to restrict access to Longwatch devices to authorized administrators only; deploy WAF rules to block suspicious HTTP requests to known vulnerable endpoints; consider disabling the affected endpoint if operationally feasible. Within 30 days: Monitor vendor communications for patch availability; evaluate replacement or alternative solutions if patches remain unavailable; conduct forensic analysis of device logs for signs of prior exploitation.

Longwatch CVE-2025-13658

EUVD-2025-200299 CRITICAL

Code Injection (CWE-94)

2025-12-02 ics-cert@hq.dhs.gov

RCE Code Injection

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 14:04 euvd

EUVD-2025-200299

Analysis Generated

Mar 15, 2026 - 14:04 vuln.today

CVE Published

Dec 02, 2025 - 20:15 nvd

CRITICAL 9.3

DescriptionCVE.org

A vulnerability in Longwatch devices allows unauthenticated HTTP GET requests to execute arbitrary code via an exposed endpoint, due to the absence of code signing and execution controls. Exploitation results in SYSTEM-level privileges.

Analysis

Technical ContextAI

Remote code execution allows an attacker to run arbitrary commands or code on the target system over a network without prior authentication. This vulnerability is classified as Code Injection (CWE-94).

RemediationAI

Apply vendor patches immediately. Restrict network access to vulnerable services. Implement network segmentation and monitoring for anomalous activity.