CVE-2025-56267

CriticalCVSS 9.8

Published: 08/09/2025(UTC)Updated: 07/11/2026(UTC)Translated: 07/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.72%

54th percentile - higher than 54% of all known CVEs

Summary

A CSV injection vulnerability in the /id_profiles endpoint of Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code by supplying a crafted Excel file.

Risk Assessment

An attacker could execute malicious code on the workstation of a user opening the file, potentially leading to account or system compromise.

Recommendation

Update Avigilon ACM and implement input validation and user education regarding opening untrusted files.

Other vulnerabilities in Avigilon ACM

CVE-2025-56266Critical
A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code by supplying a crafted URL.

Original NVD description (English source)

A CSV injection vulnerability in the /id_profiles endpoint of Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via suuplying a crafted Excel file.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS