CVE-2025-13913

CWE-502Published: March 12, 2026· Updated: Mar 17, 2026

6.3

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:7.1th

Official Description

A privileged Ignition user, intentionally or otherwise, imports an external file with a specially crafted payload, which executes embedded malicious code.

NVD Source

Technical Analysis

CVE-2025-13913 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 6.3.

From a weakness classification perspective (CWE-502): Insecure deserialization vulnerabilities allow attackers to inject malicious objects during deserialization, potentially enabling remote code execution.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorAdjacent

Attack ComplexityHigh

Privileges Req.High

User InteractionRequired

ScopeUnchanged

Impact

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time

Exploit-DB

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

PacketStorm

Security advisories & exploits

External links open in a new tab. Always verify in a controlled environment before use.

News & Research Mentioning CVE-2025-13913

Inductive Automation Ignition Software

CISA Alerts· Mar 12, 2026

View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to execute malicious code with OS application service account permissions that the authenticated, privileged application user did not intend on running. The following versions of Inductive Automation Ignition Software are affected: Ignition Software <8.3.0 (CVE-2025-13913) CVSS Vendor Equipment Vulnerabilities v3 6.3 Inductive Automation Inductive Automation Ignition Software Deserialization of Untrusted Data Background Critical Infrastructure Sectors: Information Technology Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2025-13913 A privileged Ignition user, intentionally or otherwise, imports an [xlite_meta score:79 src:CISA Alerts xlite_fp:14897fa45df85a20e087a7669732b6a857e510888a4f6fd096f24c9954ad168a]