CVE-2025-13932CWE-639

CVE-2025-13932

published December 5, 2025

CVSS

8.3

EPSS

Percentile

16.8

In the wild

Unconfirmed

What it is

The SolisCloud API suffers from a Broken Access Control vulnerability, specifically an Insecure Direct Object Reference (IDOR), where any authenticated user can access detailed data of any plant by altering the plant_id in the request.

The record

Technical detail

CVSS: 8.3 · NONE
CVSS v4.0: Not supplied
EPSS: 0.00260 · 16.8th percentile
Weakness: CWE-639 · Authorization Bypass Through User-Controlled Key
Published: 2025-12-05T03:15Z

References (1)

https://www.cisa.gov/news-events/ics-advisories/icsa-25-338-06 · [email protected]

EPSS history

Timeline

04 DEC 21:17Z
The SolisCloud API suffers from a Broken Access Control vulnerability, specifically an Insecure Direct Object Reference (IDOR), where any authenticated user…
cvelistv5