CISA Warns: Critical Iskra iHUB Flaw (CVE-2025-13510) Allows Unauthenticated Smart Metering Takeover

CISA warns of a critical flaw in Iskra’s iHUB and iHUB Lite smart metering gateways (CVE-2025-13510) that could allow unauthenticated remote takeover of devices, with a CVSS v3.1 base score of 9.1 and affecting all versions of the two device lines. According to the CISA advisory, the web management interface is exposed without requiring authentication, enabling unauthenticated users to access and modify critical device settings, effectively leaving the administrative panel unlocked.

The advisory notes that exploitation could let a remote attacker reconfigure devices, update firmware and manipulate connected systems without any credentials, potentially disrupting services, establishing persistence and enabling pivot attacks downstream from the gateway. There is currently no vendor patch available, and Iskra did not respond to CISA’s request for coordination, leaving affected organisations without an official fix timetable.

The vulnerability was originally reported to CISA by researcher Souvik Kandar, and CISA is urging immediate defensive measures to isolate these devices from the public internet. 3 December 2025.