Broadcast Hijack: Critical KiloView Flaw (CVSS 9.8) Grants Full Control

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a high-priority alert regarding a maximum-severity vulnerability in KiloView, a popular brand of video encoding and streaming devices. The flaw, tracked as CVE-2026-1453, carries a critical CVSS score of 9.8, signaling that it is both easy to exploit and devastating in its impact.

The vulnerability stems from a fundamental failure in the device’s security architecture: missing authentication for critical functions. This oversight effectively leaves the digital front door unlocked, allowing anyone with network access to walk in and take over.

According to the advisory, the flaw allows unauthorized users to perform administrative actions without ever logging in. “A missing authentication for critical function vulnerability in KiloView Encoder Series could allow an unauthenticated attacker to create or delete administrator accounts”.

By creating a new admin account—or deleting existing ones—an attacker can lock out legitimate owners and seize complete command of the device. As the advisory states, “This vulnerability can grant the attacker full administrative control over the product”.

For broadcasters and streaming professionals, the risks are severe. An attacker could disrupt live feeds, replace content with malicious streams, or use the compromised device as a pivot point to attack the wider production network.

The vulnerability affects a wide range of KiloView’s Encoder Series products, specifically those running certain firmware versions on specific hardware revisions. The advisory lists the following as compromised:

• Encoder Series E1 (Hardware V1.4 and V1.6.20)
• Encoder Series E1-s (Hardware V1.4)
• Encoder Series E2 (Hardware V1.7.20 and V1.8.20)

Specific firmware versions cited include 4.7.2516, 4.8.2523, 4.8.2611, and several others across the different hardware models.

With a CVSS score of 9.8, this vulnerability represents an imminent threat. Administrators using KiloView encoders in their broadcast workflows are urged to audit their hardware versions immediately and apply vendor-supplied updates or isolate these devices from untrusted networks until a fix can be verified.

Related Posts:

• CVE-2025-57803: Critical Flaw in ImageMagick Could Lead to Remote Code Execution
• Google Discover Evolves into a Multimedia Hub, Integrating Instagram, X, and YouTube
• NB65 released 786.2GB data from the All-Russia State Television and Radio Broadcasting Company