CVE-2025-13160VulnerabilityPublished 14 Nov 2025

CVE-2025-13160: IQ Service International IQ-Support · Exposure of Sensitive System Information to an Unauthorized Control Sphere

Affects IQ Service International IQ-SupportSource CVE Database V5

Not known to be exploited · CVSS 6.9 Medium.

Data as of 26 Oct 2026, 08:11 UTC

CVSS 4.0 base score

6.9Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.3% chance of exploitation in 30 days – higher than 26% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable system confidentiality: Low
Vulnerable system integrity: None
Vulnerable system availability: None
Subsequent system confidentiality: None
Subsequent system integrity: None
Subsequent system availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Attack Requirements: None: The successful attack does not depend on the deployment and execution conditions of the vulnerable system. The attacker can expect to be able to reach the vulnerability and execute the exploit under all or most instances of the vulnerability.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without interaction from any human user, other than the attacker.
Vulnerable system confidentiality: Low: There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the Vulnerable System.
Vulnerable system integrity: None: There is no loss of integrity within the Vulnerable System.
Vulnerable system availability: None: There is no impact to availability within the Vulnerable System.
Subsequent system confidentiality: None: There is no loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System.
Subsequent system integrity: None: There is no loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System.
Subsequent system availability: None: There is no impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System.

Definitions: FIRST CVSS v4.0 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 14 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
IQ Service International IQ-Support	Affected =1.0	Fixed in–

AI-suggested

1. Immediately restrict external network access to IQ-Support APIs by implementing network segmentation and firewall rules that limit API exposure to trusted internal networks only. 2. Enforce strong authentication and authorization mechanisms on all IQ-Support API endpoints to prevent unauthenticated access. 3. Conduct a thorough audit of all exposed APIs and disable or restrict any that are not essential for operational purposes. 4. Monitor network traffic for anomalous API requests or scanning activity targeting IQ-Support services to detect potential exploitation attempts early. 5. If possible, deploy virtual patching via web application firewalls (WAFs) or intrusion prevention systems (IPS) to block unauthorized API calls until an official patch is released. 6. Engage with IQ Service International for updates on patches or security advisories and apply official fixes promptly once available. 7. Implement strict logging and alerting on IQ-Support access to maintain visibility into usage patterns and potential abuse. 8. Educate IT and security teams about the vulnerability and the importance of securing support tools, which are often overlooked attack vectors. 9. Review and update incident response plans to include scenarios involving reconnaissance and information disclosure vulnerabilities. 10. Consider isolating IQ-Support instances in dedicated environments with minimal network exposure to reduce risk.

Description

IQ-Support developed by IQ Service International has a Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to access specific APIs to obtain sensitive information from the internal network.

Impact

For European organizations, the exposure of sensitive internal network information can significantly increase the risk of targeted attacks, including advanced persistent threats (APTs) and ransomware campaigns. Attackers gaining reconnaissance data can identify critical assets, system configurations, and potential vulnerabilities, enabling more effective exploitation. This can lead to data breaches, operational disruptions, and reputational damage. Industries with high reliance on IQ-Support for system maintenance or diagnostics, such as manufacturing, healthcare, and critical infrastructure, may face increased operational risks. The medium severity rating reflects that while direct system compromise is not immediate, the information disclosure can be a critical enabler for subsequent attacks. European organizations operating in tightly regulated sectors must also consider compliance implications related to unauthorized data exposure. The vulnerability's ease of exploitation without authentication means attackers can scan and target vulnerable systems broadly, increasing the threat landscape. Additionally, the lack of known exploits currently does not preclude future weaponization, necessitating prompt mitigation. The impact is compounded in environments where IQ-Support interfaces with sensitive or critical systems, potentially exposing internal network topology or credentials. Overall, the vulnerability undermines confidentiality and can indirectly affect integrity and availability through follow-on attacks.

CWE-497Exposure of Sensitive System Information to an Unauthorized Control Sphere (opens in a new tab)
Base weaknessOWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.
Architecture and Design · Implementation
Production applications should never use methods that generate internal details such as stack traces and error messages unless that information is directly committed to a log that is not viewable by the end user.
OWASP Cheat Sheets
Error Handling (opens in a new tab)
Authorization (opens in a new tab)
OWASP ASVS 4.0.3
V14.3.2 (opens in a new tab)
V8.3.4 (opens in a new tab)
V14.3.3 (opens in a new tab)
Attack patterns
Web Application Fingerprinting (opens in a new tab)
System Location Discovery (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 21 Nov 2025, 04:51 UTC

WeaknessesCWE-497

Technical details

References

Community reviews

Related threats