Backstory
Avigilon was founded in Vancouver, British Columbia in 2004 by Alexander Fernandes, initially building high-definition video surveillance hardware and analytics. The company expanded into physical access control in May 2012 by acquiring RedCloud Security, whose product became the foundation of what is now Access Control Manager (ACM). Avigilon then layered hardware partnerships on top of that codebase, integrating Mercury Security controllers (Mercury was itself acquired by HID Global in 2017) and HID VertX EVO controllers. Motorola Solutions announced its acquisition of Avigilon on February 1, 2018 and closed the deal on March 28, 2018 at roughly one billion US dollars enterprise value. ACM today ships under the Motorola Solutions umbrella, carrying the layered heritage of an in-house Avigilon platform, an absorbed RedCloud access stack, and integrations against Mercury and HID controllers.
The bug class behind CVE-2025-56267 is older than ACM itself. James Kettle of PortSwigger documented formula injection in 2014, showing that any web application exporting user-controlled data to CSV would let an attacker inject a leading =, +, -, or @ that a spreadsheet program would later evaluate as a formula. OWASP added CSV Injection to its community attack catalog and to the Web Security Testing Guide, and MITRE registered CWE-1236 as the canonical weakness identifier. For the next decade the class accumulated CVEs in CRM systems, helpdesks, password managers, and enterprise reporting tools. Almost every documented instance is client-side: the formula fires when a human opens the exported file in Excel, LibreOffice Calc, or Google Sheets. CVE-2025-56267 fits that pattern, despite its CVSS 9.8 score suggesting otherwise.
The physical security vertical has historically lagged general IT on vulnerability management. Equipment lifecycles of ten to twenty years, integrator-managed installations, and infrequent patching cycles mean issues that would be routine bug-bounty payouts in a SaaS product can sit in deployed systems for years. Prior CVEs against HID Mercury controllers shipped through Carrier LenelS2 in 2022 and against Genetec Security Center in 2025 fit the same pattern. Public records show no Avigilon advisory acknowledging CVE-2025-56267, no CERT-coordinated disclosure, and no vendor patch note as of this writing — eight months after disclosure. The only public artifacts are the NVD entry and the researcher's own GitHub writeup.
Technical analysis (revisited)
The original CVE Brief analyst comment, generated at disclosure time from the NVD summary, framed this as a server-side RCE — and assigned CVSS 9.8 weight to that framing. Eight months of public information now contradicts that read. The researcher's own advisory describes a textbook client-side CSV injection in ACM's /id_profiles export endpoint. Identity-field values supplied to ACM are not neutralized for leading =, +, -, @ characters, so attacker-controlled formulas flow through unchanged into the exported file. When an ACM operator opens that file in Excel or LibreOffice Calc on their workstation, the spreadsheet engine evaluates the formula in the operator's user context.
The CWE classification matches: NVD assigns CWE-1236 (Improper Neutralization of Formula Elements in a CSV File). What does not match is the CVSS vector. The published 9.8 uses AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network attack, low complexity, no privileges, no user interaction. The actual exploit chain requires an authenticated user to upload the crafted identity record AND a privileged operator to later open the exported CSV. A vector closer to AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H (~7.6) would be defensible; community equivalents like CVE-2019-20184 in KeePass land in the 6.x range. Treat the 9.8 here as a CVSS-scoring artifact, not as ground truth.
The teaching moment is the gap between the scoring and the actual exploit path. CSV injection becomes a server-side problem only when the application itself opens the CSV with a spreadsheet engine — LibreOffice in headless mode for PDF conversion, Apache POI evaluating formulas during a backend rendering step, etc. ACM does not appear to do that. So while the formula injection is real, the impact path runs through an operator's desktop spreadsheet, not the ACM server.
Lifecycle timeline
Real-world outcome
CVE-2025-56267 has not been listed on the CISA Known Exploited Vulnerabilities catalog as of this writeup. No public in-the-wild reports name it. No security firm has published a follow-up technical analysis beyond restating the NVD summary; the Kenya Education Network CERT writeup is essentially the only second-hand coverage. Searching Tenable, Qualys, and Rapid7's public databases returns no detection plugin for this CVE.
That outcome is consistent with what the bug actually is. A client-side formula injection requiring an authenticated upload plus an operator to open an exported file is not the kind of weapon opportunistic attackers mass-scan for. It is a useful pivot in a targeted intrusion where an attacker already has access to ACM and wants to compromise an operator workstation — but those attackers are not the audience for opportunistic KEV-feed-driven scanning.
The more notable absence is the vendor response. Eight months after public disclosure, Motorola Solutions has issued no advisory acknowledging CVE-2025-56267 on its public security pages, and no fixed-version note appears in ACM release documentation that we could find. A sibling CVE disclosed against the same ACM 7.10.0.20 build by the same researcher (CVE-2025-56266) is in similar limbo. Whether the vendor has silently patched in a later build, decided not to remediate, or simply has not published is a question the public record does not answer.
Lessons
The defensive moves break into two categories. For the bug class:
- Treat any CSV export as untrusted output, not as a data dump. Sanitize on the way out: prefix any cell starting with
=, +, -, @, or tab/newline with a single quote, or wrap the entire field in quotes if your downstream consumer tolerates it. The OWASP guidance is short and concrete.
- Audit your own administrative export functions. Any internal tool that exports user-controlled data and emails it to operators is a candidate. Bug-bounty programs find these constantly; the same patterns sit in internal tools no one tests.
- Train operators to open exports from systems-of-record in spreadsheet programs with macros disabled, or in tools that don't evaluate formulas at all (a text editor will tell you whether a "name" field starts with
=DDE(...)).
For the vendor-response pattern in physical security:
- Maintain your own CVE radar for installed physical-security products, not just the IT stack. Vendors in this vertical publish advisories inconsistently; relying on the vendor to tell you is unreliable.
- Read the CVSS vector, not the score. A 9.8 with no documented vendor patch and no KEV listing eight months later is usually telling you something about the score, not the world.
- For long-deployed physical security equipment, run inventory queries periodically against the public CVE feed. runZero-style asset queries work for ACM, Genetec, Lenel, HID, and the other major brands.
References