External risk intelligence

Avigilon ACM CSV Injection Allows Arbitrary Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-56267

The vulnerability affects Avigilon Access Control Manager (ACM), which is a security management appliance typically deployed as an edge or gateway service for managing physical access. These systems often provide web-based management interfaces that are frequently exposed to internal networks or, in many cases, bridged to remote access points or public-facing portals for administrative convenience.

Avigilon Access Control Manager

7.10.0.20

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability identified in Avigilon Access Control Manager. The flaw allows for arbitrary code execution through specially crafted Excel files uploaded via a specific endpoint, potentially impacting systems responsible for physical access control. The main concern is confirming relevance and exposure.

Flaw lets attackers run code using bad Excel files.
Protects physical access systems and critical infrastructure.
Assess if Avigilon Access Control Manager is in use.

Attack Path

How an attacker could exploit the issue

An attacker can reach this vulnerability by submitting a specially crafted Excel file to the /id_profiles endpoint. This file is then processed by the system, leading to arbitrary code execution. The risk is amplified because no authentication or user interaction is required for the attack to succeed.

No authentication or user interaction needed.
Crafted Excel file submitted to endpoint.
Arbitrary code execution possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code on the affected system by uploading a specially crafted Excel file through the /id_profiles endpoint. This could impact the confidentiality, integrity, and availability of the system.

System data and services are at risk.
Code execution via crafted Excel file upload.
Compromise of system integrity and availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership of this vulnerability likely falls to the teams managing physical security infrastructure, such as dedicated security or facilities teams, with potential involvement from IT infrastructure or platform teams depending on how the Avigilon ACM is deployed and managed. The first practical step is to identify all instances of the affected Avigilon ACM software, confirm their network exposure and business criticality, and then assign an accountable owner to plan remediation.

Security or infrastructure teams own the issue.
Verify ACM instance exposure and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Avigilon Access Control Manager?

Avigilon Access Control Manager is a software appliance used to manage physical building security, such as digital keycard systems and electronic door access. It serves as a centralized hub for monitoring facility entry points and maintaining user identification profiles.

What does CSV injection mean in CVE-2025-56267?

This vulnerability falls under the CWE-1236 weakness class. It occurs when a system processes untrusted data without sufficient validation. In this case, the software treats malicious instructions embedded within an uploaded Excel file as legitimate commands, allowing the file to trigger unauthorized code execution on the underlying server.

How does an attacker trigger this vulnerability?

An attacker triggers this flaw by submitting a specifically formatted Excel file to the /id_profiles endpoint. The vulnerability does not require the attacker to have an account or login to the system; simply reaching that specific web address with the malicious file is sufficient to initiate the unintended code execution.

Is my system at risk if it is not internet-facing?

Halo Surface Signal indicates this software is often deployed as a gateway for security hardware, making it a high-priority asset. While internet-facing instances are most easily reached, any system on a network path accessible to an attacker is potentially at risk, regardless of whether it is public or internal.

Do I need to act if I use Avigilon ACM?

Yes. First, perform an inventory to locate all instances of Avigilon ACM version 7.10.0.20 in your environment. Once identified, document their network placement and business impact to prioritize them, then coordinate with your security or infrastructure teams to plan remediation and restrict access to the affected endpoint.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.