Auth bypass in Iskra Ihub And Lite

CVE-2025-13510

The Iskra iHUB and iHUB Lite smart metering gateway exposes its web management interface without requiring authentication, allowing unauthenticated users to access and modify critical device settings.

Vulnerability class: Broken Authentication

EPSS: 0.006 (45.5th percentile) — read the EPSS interpretation.

Affected products

Iskra Ihub And Lite — versions All versions

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

ics-cert@hq.dhs.gov (government-resource)