CVE-2025-13160 is a vulnerability identified in IQ-Support version 1.0, a product developed by IQ Service International. The flaw involves an exposure of sensitive system information (CWE-497) through unauthenticated access to specific APIs. Attackers can remotely connect to the affected system without any authentication or user interaction and retrieve sensitive internal network data. This vulnerability arises due to insufficient access controls on certain API endpoints, allowing unauthorized entities to query information that should be restricted. The vulnerability affects confidentiality but does not impact integrity or availability directly. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality. No known exploits have been observed in the wild yet, and no official patches have been released. The exposure of sensitive information could facilitate reconnaissance activities by attackers, potentially leading to more severe follow-on attacks such as lateral movement or targeted intrusions. IQ-Support is typically used for support and diagnostic purposes, often within internal enterprise environments, making the exposure of internal network details particularly concerning. The vulnerability was published on November 14, 2025, and assigned by TW-CERT. Organizations running IQ-Support 1.0 should assess their exposure and implement mitigations promptly.

For European organizations, this vulnerability presents a moderate risk primarily through unauthorized disclosure of sensitive internal network information. Such exposure can aid attackers in mapping internal infrastructure, identifying critical assets, and planning more sophisticated attacks such as lateral movement, privilege escalation, or data exfiltration. Industries relying on IQ-Support for internal diagnostics or support, including manufacturing, healthcare, and critical infrastructure sectors, may face increased risk of targeted attacks. The lack of authentication and user interaction requirements lowers the barrier for exploitation, increasing the likelihood of opportunistic scanning and data harvesting. Although no direct impact on system integrity or availability is reported, the confidentiality breach can undermine trust, violate data protection regulations such as GDPR, and lead to compliance penalties. The absence of patches means organizations must rely on network-level controls and monitoring to reduce exposure. The threat is more pronounced in environments where IQ-Support is accessible from less trusted network segments or exposed to the internet.

Given the absence of official patches, European organizations should implement specific mitigations to reduce risk. First, restrict network access to IQ-Support APIs by enforcing strict firewall rules and network segmentation, ensuring only trusted internal hosts can communicate with the service. Employ VPNs or zero-trust network access solutions to limit exposure. Conduct thorough audits of IQ-Support deployment configurations to disable or restrict access to vulnerable API endpoints if possible. Implement robust network monitoring and intrusion detection systems to identify unusual API access patterns indicative of exploitation attempts. Regularly review and update access control policies and ensure that IQ-Support instances are not exposed to public or untrusted networks. Engage with IQ Service International for updates or patches and plan for timely application once available. Additionally, consider deploying web application firewalls (WAFs) with custom rules to block unauthorized API requests. Finally, maintain comprehensive incident response plans to quickly address any detected exploitation attempts.