CVE-2025-9265

A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving them access to state changing actions that should only be initiated by administratorsThis issue affects Kiloview NDI N30 and was fixed in Firmware version later than 2.02.0246

CVSS

No CVSS.

References

Link	Resource
https://www.kiloview.com/en/support/download/n30-firmware-downloadlatest/

Configurations

No configuration.

History

18 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de autorización rota en Kiloview NDI N30 permite a un atacante remoto no autenticado desactivar la verificación de usuario, dándoles acceso a acciones que cambian el estado que solo deberían ser iniciadas por administradores. Este problema afecta a Kiloview NDI N30 y fue solucionado en la versión de firmware posterior a la 2.02.0246.

Information

Published : 2025-10-13 07:15

Updated : 2026-10-18 21:10

NVD link : CVE-2025-9265

Mitre link : CVE-2025-9265

CVE.ORG link : CVE-2025-9265

JSON object : View

Products Affected

No product.

CWE

CWE-287

Improper Authentication

CWE-290

Authentication Bypass by Spoofing

CWE-346

Origin Validation Error

{"id": "CVE-2025-9265", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9265", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-10-14T13:19:29.801041Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "vulnerability@ncsc.ch", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 10.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "vulnerability@ncsc.ch", "affectedData": [{"vendor": "Kiloview", "product": "NDI", "versions": [{"status": "affected", "version": "2.02.246", "versionType": "N30 Firmware"}], "collectionURL": "https://www.kiloview.com/en/support/download/n30-for-ndi/", "defaultStatus": "affected"}]}], "published": "2025-10-13T07:15:56.677", "references": [{"url": "https://www.kiloview.com/en/support/download/n30-firmware-downloadlatest/", "source": "vulnerability@ncsc.ch"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "vulnerability@ncsc.ch", "description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-290"}, {"lang": "en", "value": "CWE-346"}]}], "descriptions": [{"lang": "en", "value": "A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving them access to state changing actions that should only be initiated by administratorsThis issue affects \n\n Kiloview NDI N30\n\nand was fixed in Firmware version later than 2.02.0246"}, {"lang": "es", "value": "Una vulnerabilidad de autorizaci\u00f3n rota en Kiloview NDI N30 permite a un atacante remoto no autenticado desactivar la verificaci\u00f3n de usuario, d\u00e1ndoles acceso a acciones que cambian el estado que solo deber\u00edan ser iniciadas por administradores.\n\nEste problema afecta a Kiloview NDI N30 y fue solucionado en la versi\u00f3n de firmware posterior a la 2.02.0246."}], "lastModified": "2026-10-18T21:10:00.120", "sourceIdentifier": "vulnerability@ncsc.ch"}