CVE-2025-56267
Published: 08 September 2025
Summary
CVE-2025-56267 is a critical-severity Improper Neutralization of Formula Elements in a CSV File (CWE-1236) vulnerability in Avigilon Access Control Manager. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 38.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the CSV injection flaw in Avigilon ACM v7.10.0.20's /id_profiles endpoint by identifying, testing, and deploying patches to prevent arbitrary code execution.
Validates all supplied Excel files and inputs to the /id_profiles endpoint to reject crafted payloads that exploit the CSV injection vulnerability.
Implements memory protections to mitigate arbitrary code execution on the server even if a crafted Excel file bypasses input validation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSV injection in /id_profiles endpoint enables injecting malicious formulas into exported CSV/Excel files, executing arbitrary code when opened by users in spreadsheet software (T1204.002: Malicious File).
NVD Description
A CSV injection vulnerability in the /id_profiles endpoint of Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via suuplying a crafted Excel file.
Deeper analysisAI
CVE-2025-56267 is a CSV injection vulnerability in the /id_profiles endpoint of Avigilon ACM version 7.10.0.20. The flaw allows attackers to execute arbitrary code by supplying a crafted Excel file. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-1236. The vulnerability was published on 2025-09-08.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By targeting the /id_profiles endpoint with a crafted Excel file, an attacker achieves arbitrary code execution, resulting in high confidentiality, integrity, and availability impacts.
Exploit details, including proof-of-concept code for the CSV injection, are documented in GitHub repositories at https://github.com/nikolas-ch/CVEs/blob/main/AvigilonACM_v7.10.0.20/CSV_Injection/CSV_Injection.txt and related directories. No official advisories or patches are referenced in available information.
Details
- CWE(s)