by Kastro
Paper/Archive/CVE-2025-13510

CVE-2025-13510

Iskra iHUB and iHUB Lite — Iskra iHUB and iHUB Lite has a Missing Authentication for Critical Function vulnerabilitiy

EPSS 0.6%CVSS 9.3
critical.is priorityof 100
38
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 49.8.498 × 2010.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Iskra iHUB and iHUB Lite smart metering gateway exposes its web management interface without requiring authentication, allowing unauthenticated users to access and modify critical device settings.

Affected

ProductAffectedFixed inSource
iHUB and iHUB LiteAll versions–CNA

Scores by source

icscert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refcisa.gov/news-events/ics-advisories/icsa-25-336-02