Critical severity · published Oct 13, 2025
CVE-2025-9265
API Authentication Bypass via Header Spoofing vulnerability in Kiloview NDI N30 Products
10.0
CVSS
0.2%
EPSS
No
On KEV
Description
A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving them access to state changing actions that should only be initiated by administratorsThis issue affects
Kiloview NDI N30
and was fixed in Firmware version later than 2.02.0246
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ND
NDI · Kiloview
2.02.246 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-9265
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-9265
www.kiloview.com
https://www.kiloview.com/en/support/download/n30-firmware-downloadlatest/
More from NDI
9.8
CVE-2024-2161
Use of Hard-coded Credentials in Kiloview NDI N series products API middleware
8.8
CVE-2024-2162
Authenticated Remote Code Execution in Kiloview NDI N series products