CVE-2025-9265: API Authentication Bypass via Header Spoofing vulnerability in Kiloview NDI N30 Products
Vulnerability summary
CVE-2025-9265 is a critical (CVSS 10.0) Improper Authentication vulnerability in kiloview ndi. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.4% of scored vulnerabilities.
Timeline
- 13-10-2025PublishedVulnerability first disclosed.
- 14-10-2025Last modifiedVulnerability information updated.
Description
A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving them access to state changing actions that should only be initiated by administratorsThis issue affects Kiloview NDI N30 and was fixed in Firmware version later than 2.02.0246
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST10.0CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.24%
Chance of exploitation in the next 30 days
Percentile
14%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.24% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- CWE-290Authentication Bypass by SpoofingThis attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
- CWE-346Origin Validation ErrorThe product does not properly verify that the source of data or communication is valid.
Affected systems
Kiloview1 product
- ndi2.02.246
1 vendor · 1 product