What’s Vulnerable › Vulnerabilities

CVE-2025-9265: API Authentication Bypass via Header Spoofing vulnerability in Kiloview NDI N30 Products

• Severity: critical (CVSS 10.0 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-13 · updated 2026-10-18
• Weakness: CWE-287

Description

A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving them access to state changing actions that should only be initiated by administratorsThis issue affects Kiloview NDI N30 and was fixed in Firmware version later than 2.02.0246

Affected products

• Kiloview NDI: 2.02.246

References

• https://www.kiloview.com/en/support/download/n30-firmware-downloadlatest/

Get alerted when CVE-2025-9265 or the next vulnerability affects your stack