CVE-2025-13319 — Authenticated SQL injection in API - Digi On-Prem Manager

CVE-2025-13319

Authenticated SQL injection in API - Digi On-Prem Manager PUBLISHED

Description (CNA)

An injection vulnerability has been discovered in the API feature in Digi On-Prem Manager, enabling an attacker with valid API tokens to inject SQL via crafted input. The API is not enabled by default, and a valid API token is required to perform the attack.

Affected (CNA)

Vendor / product	Versions
Nettec AS / Digi On-Prem Manager	affected 24.12.5 before 25.08.5

CWE

CWE-20, CWE-89

References

https://dom.nettec.no/security-advisories/DOM-25-001/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.