Kiloview E3 NDI Encoder Has Nine Flaws
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
CISA details nine vulnerabilities in Kiloview E3 NDI encoder firmware, including unauthenticated root command injection, that together enable full device compromise.
CISA published an ICS advisory for the Kiloview E3 NDI video encoder covering nine distinct vulnerabilities in firmware versions prior to 1.30. The most severe issues allow an authenticated web user to inject arbitrary OS commands as root through unsanitized parameters in the static-route configuration, device-naming, and network-interface-name endpoints (CVE-2026-109122, CVE-2026-107861, CVE-2026-110243). Compounding this, the device's authentication framework signs session JWTs with a hardcoded HMAC-SHA256 secret identical across all units (CVE-2026-92450), meaning anyone who extracts the secret from the publicly available firmware image can forge administrative session tokens and reach these command-injection endpoints without any valid credentials — effectively making the root-RCE issues remotely exploitable without authentication when chained.
Additional issues include an ONVIF service that leaks device identifiers and configured user accounts without authentication (CVE-2026-111100), ONVIF hostname/DNS/NTP write operations that are accepted without authentication regardless of device settings, enabling DNS redirection or time-source tampering (CVE-2026-110825), non-expiring session tokens that remain valid indefinitely once issued (CVE-2026-96616), a path traversal in the timezone parameter allowing /etc/localtime to be redirected outside the zoneinfo directory (CVE-2026-105265), and a NULL pointer dereference in the ONVIF service allowing a remote unauthenticated attacker to repeatedly cause a denial of service that self-recovers (CVE-2026-110491). Combined CVSS v3 scoring reaches 9.9 for the chainable issues.
CISA states no known public exploitation has been reported at this time. Kiloview, headquartered in China, recommends updating all affected E3 devices to firmware version 1.30. CISA's standard ICS guidance applies: minimize internet exposure of these devices, isolate control/broadcast system networks behind firewalls, and use VPNs for any required remote access. The affected sectors per CISA's background are Communications and Information Technology, with worldwide deployment.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 13,989 reports from 143 sources, 543 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs