What is the CVSS score of CVE-2025-13932?

CVE-2025-13932 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2025-13932?

Within 24 hours: Disable SolisCloud API access or restrict it to read-only minimal-privilege accounts; document all API users and their plant access assignments. Within 7 days: Implement network-level API gateway controls to validate plant_id against authenticated user's authorized plant list; conduct access logs audit to identify unauthorized data access. Within 30 days: Work with vendor on patch deployment; implement API request signing/validation; deploy WAF rules to reject requests with mismatched user-plant relationships; migrate to API keys with granular permission scoping.

CVE-2025-13932

EUVD-2025-201308 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2025-12-04 ics-cert@hq.dhs.gov

Authentication Bypass

8.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 16:35 euvd

EUVD-2025-201308

Analysis Generated

Mar 15, 2026 - 16:35 vuln.today

CVE Published

Dec 04, 2025 - 22:15 nvd

HIGH 8.3

DescriptionCVE.org

The SolisCloud API suffers from a Broken Access Control vulnerability, specifically an Insecure Direct Object Reference (IDOR), where any authenticated user can access detailed data of any plant by altering the plant_id in the request.