# Kiloview E3 NDI Encoder Has Nine Flaws

Published: 2026-10-22 · Severity: routine · Sectors: Telecommunications, Technology
Canonical: https://vorant.io/reports/44cbd629-a3a9-5a1f-aa31-4d739296d01e/kiloview-e3-ndi-encoder-has-nine-flaws

> CISA details nine vulnerabilities in Kiloview E3 NDI encoder firmware, including unauthenticated root command injection, that together enable full device compromise.

CISA published an ICS advisory for the Kiloview E3 NDI video encoder covering nine distinct vulnerabilities in firmware versions prior to 1.30. The most severe issues allow an authenticated web user to inject arbitrary OS commands as root through unsanitized parameters in the static-route configuration, device-naming, and network-interface-name endpoints (CVE-2026-109122, CVE-2026-107861, CVE-2026-110243). Compounding this, the device's authentication framework signs session JWTs with a hardcoded HMAC-SHA256 secret identical across all units (CVE-2026-92450), meaning anyone who extracts the secret from the publicly available firmware image can forge administrative session tokens and reach these command-injection endpoints without any valid credentials — effectively making the root-RCE issues remotely exploitable without authentication when chained.

Additional issues include an ONVIF service that leaks device identifiers and configured user accounts without authentication (CVE-2026-111100), ONVIF hostname/DNS/NTP write operations that are accepted without authentication regardless of device settings, enabling DNS redirection or time-source tampering (CVE-2026-110825), non-expiring session tokens that remain valid indefinitely once issued (CVE-2026-96616), a path traversal in the timezone parameter allowing /etc/localtime to be redirected outside the zoneinfo directory (CVE-2026-105265), and a NULL pointer dereference in the ONVIF service allowing a remote unauthenticated attacker to repeatedly cause a denial of service that self-recovers (CVE-2026-110491). Combined CVSS v3 scoring reaches 9.9 for the chainable issues.

CISA states no known public exploitation has been reported at this time. Kiloview, headquartered in China, recommends updating all affected E3 devices to firmware version 1.30. CISA's standard ICS guidance applies: minimize internet exposure of these devices, isolate control/broadcast system networks behind firewalls, and use VPNs for any required remote access. The affected sectors per CISA's background are Communications and Information Technology, with worldwide deployment.

## Mentioned in this report

- Vulnerabilities: CVE-2026-105265, CVE-2026-107861, CVE-2026-109122, CVE-2026-110243, CVE-2026-110491, CVE-2026-110825, CVE-2026-111100, CVE-2026-92450, CVE-2026-96616

## Detection guidance (public sample)

### Web Request With Path Traversal in Timezone Parameter

ATT&CK: T1190

Detects HTTP requests where a timezone parameter carries directory traversal sequences, matching the Kiloview E3 timezone path traversal that redirects /etc/localtime outside zoneinfo. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Request With Path Traversal in Timezone Parameter
id: fe2f60ad-c542-5869-85dd-c792b8807636
status: experimental
description: Detects HTTP requests to embedded device web interfaces where a timezone
  parameter contains directory traversal sequences. Matches the path traversal in
  the timezone setting that lets an attacker point /etc/localtime outside the zoneinfo
  directory (Kiloview E3 class of flaw).
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_param:
    cs-uri-query|contains: timezone=
  selection_traversal:
    cs-uri-query|contains:
    - ../
    - ..%2f
    - '%2e%2e%2f'
    - '%2e%2e/'
    - ..%5c
    - ..\
  condition: selection_param and selection_traversal
falsepositives:
- Vulnerability scanners run by the security team against device web interfaces
- Web application tests that deliberately submit traversal strings
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01
```

### Web Request With OS Command Injection Payload in Query String

ATT&CK: T1190

Detects shell metacharacters chained with download or shell commands in web query strings, matching root command injection via device configuration parameters such as route, device name, or interface name. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Request With OS Command Injection Payload in Query String
id: b2ad591e-f3ef-52d2-aea7-dff967e93f92
status: experimental
description: Detects web requests whose query string chains a shell separator or command
  substitution with a download, netcat, or shell command. This is the pattern used
  to exploit unsanitized configuration parameters (static route, device name, interface
  name) for root command execution on embedded devices. Matches payload structure,
  not specific endpoints.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_sep_wget:
    cs-uri-query|contains:
    - ;wget
    - '|wget'
    - '`wget'
    - $(wget
    - '%3bwget'
    - '%7cwget'
    - '%60wget'
    - '%24%28wget'
    - ;curl
    - '|curl'
    - '`curl'
    - $(curl
    - '%3bcurl'
    - '%7ccurl'
    - '%60curl'
    - '%24%28curl'
  selection_shell:
    cs-uri-query|contains:
    - ;/bin/sh
    - '|/bin/sh'
    - '`/bin/sh'
    - $(/bin/sh
    - '%3b/bin/sh'
    - '%7c/bin/sh'
    - '%3bnc%20'
    - ';nc '
    - '|nc '
    - '%3bbusybox'
    - ;busybox
    - '|busybox'
  condition: 1 of selection_*
falsepositives:
- Penetration tests or vulnerability scanners probing for command injection
- Web applications that legitimately pass shell-like text in query parameters, such
  as documentation or code-sharing sites
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/44cbd629-a3a9-5a1f-aa31-4d739296d01e/kiloview-e3-ndi-encoder-has-nine-flaws.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup