Which versions of Ignition are affected by CVE-2025-13913?

Organizations using Inductive Automation Ignition Software should be aware of moderate risk from CVE-2025-13913, a insecure deserialization vulnerability rated CVSS 6.3.

How to fix or mitigate CVE-2025-13913?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Ignition CVE-2025-13913

Q: What is the CVSS score of CVE-2025-13913?

CVE-2025-13913 has a CVSS 4.0 base score of 5.4 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Deserialization of Untrusted Data (CWE-502)

2026-03-12 ics-cert@hq.dhs.gov

Deserialization Ignition

5.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

CVSS:4.0/AV:A/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Jun 05, 2026 - 19:52 NVD

6.3 (MEDIUM) 5.4 (MEDIUM)

Analysis Generated

Mar 12, 2026 - 19:57 vuln.today

CVE Published

Mar 12, 2026 - 19:16 nvd

MEDIUM 6.3

DescriptionCVE.org

Inductive Automation Ignition Software is vulnerable to an unauthenticated API endpoint exposure that may allow an attacker to remotely change the "forgot password" recovery email address.

AnalysisAI

Inductive Automation Ignition Software is vulnerable to an unauthenticated API endpoint exposure that may allow an attacker to remotely change the "forgot password" recovery email address. [CVSS 6.3 MEDIUM]

Technical ContextAI

Classified as CWE-502 (Deserialization of Untrusted Data). Inductive Automation Ignition Software is vulnerable to an unauthenticated API endpoint exposure that may allow an attacker to remotely change the "forgot password" recovery email address.

RemediationAI

Monitor vendor advisories for a patch.

CVE-2025-13913 vulnerability details – vuln.today

Back