Is CVE-2025-13809 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-13809 being exploited in the wild.

How severe is CVE-2025-13809?

Medium severity, with a CVSS score of 6.3, published 1 December 2025.

Which products and versions are affected?

Orionsec Orion-Ops up to commit 5925824997a3109651bbde07460958a7be249ed1.

Is there a fix for CVE-2025-13809?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-13809 attacked?

It is attacked over the network.

Am I affected by CVE-2025-13809?

Check whether you run Orionsec Orion-Ops at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-13809: Orion-ops server-side request forgery in SSH connection handler

CVE-2025-13809 · Severity: medium · CVSS 6.3 · Published 2025-12-01

Orion-ops is a server management tool that administrators use to test connectivity to remote machines via SSH. A flaw in the SSH connection testing feature fails to validate user input, allowing authenticated attackers to bypass intended access controls and coerce the server into connecting to arbitrary internal addresses. This enables network mapping and port discovery of internal infrastructure that should not be reachable from the attacker's location.

Technologies: Orionsec Orion-Ops. Vendors: Orionsec.

Quick answers

Is CVE-2025-13809 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-13809 being exploited in the wild.
How severe is CVE-2025-13809?: Medium severity, with a CVSS score of 6.3, published 1 December 2025.
Which products and versions are affected?: Orionsec Orion-Ops up to commit 5925824997a3109651bbde07460958a7be249ed1.
Is there a fix for CVE-2025-13809?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-13809 attacked?: It is attacked over the network.
Am I affected by CVE-2025-13809?: Check whether you run Orionsec Orion-Ops at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a server-side request forgery (SSRF) in the MachineInfoController component, specifically in the SSH connection handler endpoints POST /orion/api/machine/direct-test-connect and POST /orion/api/machine/direct-test-ping. The root cause is missing input validation and missing role-based access controls on the endpoints; user-supplied parameters (host, sshPort, username, password, authType) are forwarded directly to MachineInfoServiceImpl.testConnect without validation against a whitelist of managed machines. An authenticated attacker can exploit this to initiate arbitrary TCP connections from the Orion-ops server to internal addresses, enabling network reconnaissance and port scanning. The attack requires an existing authenticated session but no special privileges. No official patch has been published as of the disclosure date.

Affected products

OrionSec Orion-ops up to commit 5925824997a3109651bbde07460958a7be249ed1

Timeline

2025-12-01: disclosed
other: Exploit published on GitHub; vendor contacted early but did not respond

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.