External risk intelligence

Avigilon ACM Host Header Injection Leads to Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-56266

Avigilon Access Control Manager is an enterprise security appliance typically deployed to manage physical access points. These systems often provide web-based management interfaces that are frequently exposed to internal or external networks for remote administration and integration, making them a common target for network-based attacks against their web services.

Avigilon Access Control Manager

7.10.0.20

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A Host Header Injection vulnerability has been identified in Avigilon Access Control Manager. This issue could allow for unauthorized code execution, which is a critical concern for systems managing physical access. The primary concern at this time is to confirm if this specific technology is in use and to understand the potential exposure.

Crafty URLs could let attackers run their own code.
Critical security flaw in access control systems.
Determine if this system is in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted URL to a publicly accessible Avigilon Access Control Manager system. This crafted URL targets a weakness in how the system processes host headers, potentially leading to the execution of arbitrary code.

No authentication required.
Crafted URL triggers header processing.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A Host Header Injection vulnerability in Avigilon ACM could allow an unauthenticated attacker to execute arbitrary code by providing a specially crafted URL. This could affect the system's integrity and availability when supported by the advisory.

System code execution.
Crafted URL injection.
Arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Avigilon Access Control Manager. Responsibility likely falls to the platform or infrastructure teams managing the appliance, with potential involvement from security teams for exposure assessment and vendor management for coordination with Avigilon. The first step is to identify all instances of the affected software, confirm their network exposure and criticality, and then prioritize remediation based on risk, possibly involving vendor coordination or temporary risk reduction measures.

Platform or infrastructure teams own remediation.
Verify network exposure and business criticality.
Plan coordinated patching during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Avigilon Access Control Manager?

Avigilon Access Control Manager is an enterprise software platform used to manage physical security, such as badge readers and door locks. It functions as a central appliance that administrators use to oversee building access, often through a web-based interface that connects to the network to facilitate remote management and security operations.

What does Host Header Injection mean for CVE-2025-56266?

This vulnerability, classified as CWE-74, CWE-116, and CWE-444, occurs when the software improperly trusts the 'Host' header sent in a web request. By manipulating this header, an attacker can trick the system into processing malicious input, which, in this specific case, can result in the execution of unauthorized code on the underlying device.

How does an attacker trigger this vulnerability?

An attacker exploits this by sending a specially crafted URL to the system's web interface. This does not require any prior authentication or special user permissions to initiate. Importantly, this flaw relates to how the system handles headers; simply visiting the site normally or performing standard administrative tasks does not trigger the vulnerability.

Is my system at risk?

According to Halo Surface Signal, this software is often deployed in environments where web management interfaces are accessible across internal or external networks. If your instance of Avigilon Access Control Manager is reachable over the network, it is a potential target. Systems that are fully air-gapped or restricted to highly controlled, isolated management segments face lower immediate risk.

What should I do if I run this software?

Begin by auditing your network to identify all running instances of Avigilon ACM v7.10.0.20. Once identified, verify their network reachability to determine which are most exposed. Consult with your infrastructure or security team to plan for vendor-provided updates or risk-reduction configurations to secure the affected management interfaces.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.