CVE-2025-13510: Iskra iHUB Smart Metering Gateway Unauthenticated Web Interface

CVE-2025-13510 is a missing-authentication flaw (CWE-306) in Iskra's iHUB and iHUB Lite, a smart metering gateway and data concentrator device that aggregates readings from utility meters and exposes a web management interface with no login requirement at all, so any attacker who can reach that interface over the network can reconfigure the device, push firmware, or tamper with the connected metering systems it manages; NVD has not, as of 2026-11-08, published its own Primary CVSS score — the Secondary rating shown on this page is CISA's, and Iskra itself did not respond to CISA's coordination outreach.

CVE-2025-13510 (CWE-306, missing authentication for critical function) affects Iskra's iHUB and iHUB Lite. NVD's description states: "The Iskra iHUB and iHUB Lite smart metering gateway exposes its web management interface without requiring authentication, allowing unauthenticated users to access and modify critical device settings" (NVD).

The iHUB and iHUB Lite are physical smart-metering gateway and data-concentrator appliances: embedded devices deployed in energy-sector networks to aggregate readings from downstream electricity, gas or water meters and relay them upstream over the utility's own communications infrastructure — exactly the class of grid-facing firmware device this gap in access control directly exposes.

NVD tracks CVE-2025-13510 with status "Deferred": it records only a CISA ICS-CERT-submitted score (source [email protected]) — CVSS v4.0 9.3 (critical), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N — typed Secondary, not NVD's own Primary rating, so this page does not present that figure as NVD-confirmed (NVD).

CISA's advisory ICSA-25-336-02, published 2025-12-02, separately calculated a CVSS v3.1 base score of 9.1 (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), identifies Iskra as headquartered in Slovenia, places the product in the Energy sector, and credits researcher Souvik Kandar with reporting the flaw. Notably, the advisory states that Iskra did not respond to CISA's requests to coordinate on the disclosure, so no vendor-supplied patch or official remediation guidance exists — only CISA's own defensive mitigations: minimize network exposure for control-system devices, ensure they are not accessible from the internet, apply firewall protections and network isolation, and use a VPN for any required remote access (CISA ICS Advisory ICSA-25-336-02).

Because the flaw requires no credentials, no user interaction and is reachable over the network (AV:N, PR:N, UI:N in both scoring systems), any iHUB or iHUB Lite unit whose web management interface is reachable from an untrusted network should be treated as already compromised until it is isolated.

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.0058 (47.8th percentile) as of 2026-11-07 — a critical-severity, unauthenticated-access flaw with confirmed CISA scoring and no vendor fix, but no reported in-the-wild exploitation yet (CISA KEV, FIRST EPSS).

NVD has not finished its own severity analysis. In the meantime, operators of Iskra iHUB or iHUB Lite gateways should isolate the devices' management interfaces from any network not strictly limited to trusted metering-operations staff, since no vendor-issued fix is currently available.

• Iskra iHUB and iHUB Lite smart metering gateway exposes its web management interface without requiring authentication, allowing unauthenticated users to access and modify critical device settings. — NVD
• NVD status 'Deferred'; only a CISA ICS-CERT-submitted Secondary CVSS v4.0 base score of 9.3 is recorded, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N. — NVD
• CISA calculated CVSS v3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N); Iskra is headquartered in Slovenia and affects the Energy sector; reported by Souvik Kandar; Iskra did not respond to CISA's coordination request, so no vendor patch exists. — CISA ICS Advisory ICSA-25-336-02
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.0058 (47.8th percentile) as of 2026-11-07. — FIRST EPSS