by Kastro
Paper/Archive/CVE-2025-9265

CVE-2025-9265

Kiloview NDI — API Authentication Bypass via Header Spoofing vulnerability in Kiloview NDI N30 Products

EPSS 0.2%CVSS 10.0
critical.is priorityof 100
33
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 15.3.153 × 203.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving them access to state changing actions that should only be initiated by administratorsThis issue affects Kiloview NDI N30 and was fixed in Firmware version later than 2.02.0246

Affected

ProductAffectedFixed inSource
NDI2.02.246–CNA

Scores by source

NCSC.ch (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refkiloview.com/en/support/download/n30-firmware-downloadlatest