Skip to content
OpenAdvisories
Critical ICSA-26-295-01 9 CVEs

Kiloview E3 NDI Encoder

Published Oct 22, 2026 · Updated Oct 22, 2026

Vendor: Kiloview Product: E3 Firmware

Summary

Successful exploitation of this these vulnerabilities could allow an attacker to fully compromise the device.

Vulnerabilities 9

  • Critical 9.9
    CVE-2026-107861

    Kiloview E3 NDI Encoder OS Command Injection

    The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed…

    Kiloview E3 Firmware
  • Critical 9.9
    CVE-2026-110243

    Kiloview E3 NDI Encoder OS Command Injection

    The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform…

    Kiloview E3 Firmware
  • Critical 9.1
    CVE-2026-109122

    Kiloview E3 NDI Encoder OS Command Injection

    The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to ex…

    Kiloview E3 Firmware
  • High 7.5
    CVE-2026-110491

    Kiloview E3 NDI Encoder NULL Pointer Dereference

    The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected service stops accepting new connections while the rest of the device continues operating normally, and will recover automa…

    Kiloview E3 Firmware
  • High 7.5
    CVE-2026-110825

    Kiloview E3 NDI Encoder Missing Authentication for Critical Function

    The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this service. A remote, unau…

    Kiloview E3 Firmware
  • High 7.5
    CVE-2026-92450

    Kiloview E3 NDI Encoder Use of Hard-coded Credentials

    The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to …

    Kiloview E3 Firmware
  • Medium 6.5
    CVE-2026-96616

    Kiloview E3 NDI Encoder Insufficient Session Expiration

    Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them non-expiring. A token obtained through interception or device compromise remains valid …

    Kiloview E3 Firmware
  • Medium 5.3
    CVE-2026-105265

    Kiloview E3 NDI Encoder Path Traversal

    A vulnerability exists in the the time zone parameter and does not properly validate user input, which may allow an authenticated user to cause /etc/localtime to point to a file outside the intended zoneinfo directory .

    Kiloview E3 Firmware
  • Medium 5.3
    CVE-2026-111100

    Kiloview E3 NDI Encoder Missing Authentication for Critical Function

    The ONVIF device service on the E3 responds to certain informational requests without requiring authentication. A remote, unauthenticated party can retrieve detailed device identifiers along with a list of configured user accounts and their privilege levels. …

    Kiloview E3 Firmware

Revision history

  1. #1

    Initial Publication

References