CVE-2025-13510 CRITICAL

CVE-2025-13510: Iskra iHUB and iHUB Lite has a Missing Authentication for Critical Function vulnerabilitiy

Vendor Iskra
Product iHUB and iHUB Lite
Weakness CWE-306 · Missing auth
Published December 2, 2025
Last update December 2, 2025
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

The Iskra iHUB and iHUB Lite smart metering gateway exposes its web management interface without requiring authentication, allowing unauthenticated users to access and modify critical device settings.

Key dates

02Disclosure timeline

December 2, 2025 CVE published
December 2, 2025 Record updated