CVE-2025-9265

A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving them access to state changing actions that should only be initiated by administratorsThis issue affects Kiloview NDI N30 and was fixed in Firmware version later than 2.02.0246

Score

CVSS 4.0 10.0 Critical

Status

Deferred - vulnerability@ncsc.ch

Published

2025-10-13

Last modified

2026-10-18

Weaknesses

CWE-287, CWE-290, CWE-346

Affected products

• Ndi (Kiloview)

References

• https://www.kiloview.com/en/support/download/n30-firmware-downloadlatest/