CVE-2025-9265

Published Oct 13, 2025

Last updated 9 days ago

CVSS critical 10.0
API

Overview

Description
A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving them access to state changing actions that should only be initiated by administratorsThis issue affects Kiloview NDI N30 and was fixed in Firmware version later than 2.02.0246
Source
vulnerability@ncsc.ch
NVD status
Deferred

Risk scores

CVSS 4.0

Type
Secondary
Base score
10
Impact score
-
Exploitability score
-
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity
CRITICAL

Weaknesses

vulnerability@ncsc.ch
CWE-287

Social media

Hype score
Not currently trending

  1. 🚨 CRITICAL: CVE-2025-9265 in Kiloview NDI N30 (≤2.02.0246) lets remote attackers bypass admin controls—no auth needed! Patch now to protect your broadcast streams. 🎥 https://t.co/sVZclS28hc #OffSeq #CVE2025926... https://t.co/1mTTraYTbz

    @offseq

    13 Oct 2025

    50 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. [CVE-2025-9265: CRITICAL] Critical cybersecurity alert: Kiloview NDI N30 device vulnerability could grant unauthorized access. Update firmware to version 2.02.0246 to fix this issue. #cybersecurity#cve,CVE-2025-9265,#cybersecurity https://t.co/YIq6fdViFD https://t.co/fPnfXIMRUp

    @CveFindCom

    13 Oct 2025

    69 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. Fortinet FortiClient EMS Improper Access Control Vulnerability•CVE-2026-35616
  2. A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call.•CVE-2026-25197
  3. GCB/FCB Audit Software developed by DrangSoft has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access certain APIs to create a new administrative account.•CVE-2026-4312
  4. Improper Protection of Alternate Path exists in the no-access and workdir feature of the AWS API MCP Server versions >= 0.2.14 and < 1.3.9 on all platforms may allow the bypass of intended file access restriction and expose arbitrary local file contents in the MCP client application context. To remediate this issue, users should upgrade to version 1.3.9.•CVE-2026-4270
  5. OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.3, an unauthenticated denial-of-service vulnerability exists in OliveTin’s OAuth2 login flow. Concurrent requests to /oauth/login can trigger unsynchronized access to a shared registeredStates map, causing a Go runtime panic (fatal error: concurrent map writes) and process termination. This allows remote attackers to crash the service when OAuth2 is enabled. This issue has been patched in version 3000.10.3.•CVE-2026-28789

References

Sources include official advisories and independent security research.