CVE-2025-9265criticalCWE-287CWE-290CWE-346

CVE-2025-9265: critical vulnerability in Kiloview NDI

API Authentication Bypass via Header Spoofing vulnerability in Kiloview NDI N30 Products

Published · Updated

Follow this CVE+ Monitor NDI

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 10epss 0.2%
A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving them access to state changing actions that should only be initiated by administratorsThis issue affects Kiloview NDI N30 and was fixed in Firmware version later than 2.02.0246
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
Kiloview · NDI
Related CVEs — Kiloview NDI

In the same product, most dangerous first.

CVE-2024-2162HIGHAuthenticated Remote Code Execution in Kiloview NDI N series productsEPSS 2.1%CVE-2024-2161CRITICALUse of Hard-coded Credentials in Kiloview NDI N series products API middlewareEPSS 0.9%