CVE-2025-56266

CriticalCVSS 9.8

Published: 08/09/2025(UTC)Updated: 07/11/2026(UTC)Translated: 07/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.89%

87th percentile - higher than 87% of all known CVEs

Summary

A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code by supplying a crafted URL.

Risk Assessment

An attacker could take control of the application or execute malicious code in the server context, potentially compromising confidentiality and integrity.

Recommendation

Update Avigilon ACM to the latest version and enforce server-side Host header validation.

Other vulnerabilities in Avigilon ACM

CVE-2025-56267Critical
A CSV injection vulnerability in the /id_profiles endpoint of Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code by supplying a crafted Excel file.

Original NVD description (English source)

A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplying a crafted URL.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS