Do Son 
TL;DR
On October 22, 2026, CISA published advisory ICSA-26-295-01 covering nine Kiloview E3 vulnerabilities in the company’s NDI video encoder. Two command injection flaws score CVSS 9.9 and give attackers root access. Kiloview has fixed all nine in firmware V1.30.
- Total: 9 CVEs
- Severity: 3 Critical · 4 High · 2 Medium
- Actively exploited: None confirmed
- Highest severity: 9.9 (Critical · CVSSv3) — CVE-2026-107861
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-107861 | 9.9 | E3 NDI Encoder OS Command Injection | 1.30 | Not exploited |
| CVE-2026-110243 | 9.9 | E3 NDI Encoder OS Command Injection | 1.30 | Not exploited |
| CVE-2026-109122 | 9.1 | E3 NDI Encoder OS Command Injection | 1.30 | Not exploited |
| CVE-2026-110825 | 7.5 | E3 NDI Encoder Missing Authentication for Critical Function | 1.30 | Not exploited |
| CVE-2026-110491 | 7.5 | E3 NDI Encoder NULL Pointer Dereference | 1.30 | Not exploited |
| CVE-2026-96616 | 6.5 | E3 NDI Encoder Insufficient Session Expiration | 1.30 | Not exploited |
| CVE-2026-111100 | 5.3 | E3 NDI Encoder Missing Authentication for Critical Function | 1.30 | Not exploited |
Why It Matters
The Kiloview E3 NDI encoder turns video feeds into network streams for broadcast and live production. CISA lists it in the communications and IT sectors, deployed worldwide. According to the advisory, “successful exploitation of these vulnerabilities could allow an attacker to fully compromise the device.”
How the Attacks Work
Root-level command injection
Three Kiloview E3 vulnerabilities let a logged-in user run commands as root. For example, CVE-2026-107861 (CVSS 9.9) passes the hostname “unquoted into a shell command.” CVE-2026-110243 (CVSS 9.9) skips validation on a network interface name, “unlike sibling handlers that perform the same validation.” CVE-2026-109122 (CVSS 9.1) abuses static route settings, and its malicious configuration “persists across reboots.”
A shared secret in every device
CVE-2026-92450 (CVSS 7.5) may be the most worrying flaw. The firmware signs login tokens with a secret that is “identical across all deployed devices.” Anyone with the public firmware can recover it and “forge arbitrary session tokens, including administrative tokens.” As a result, the login requirement on the command injection bugs offers little comfort.
Unauthenticated ONVIF flaws
The ONVIF service adds more risk. CVE-2026-110825 lets anyone change hostname, DNS and NTP settings without logging in. That could enable “traffic interception or certificate validation bypass.” Meanwhile, CVE-2026-111100 leaks user accounts and privilege levels, which helps attackers plan password attacks. CVE-2026-110491 can freeze the service repeatedly.
Weaker issues
Login tokens last “far beyond any reasonable session lifetime” (CVE-2026-96616). As a result, a stolen token stays useful for a long time. A time zone path traversal rounds out the list (CVE-2026-105265).
Exploitation status
CISA says “no known public exploitation specifically targeting these vulnerabilities has been reported.” None appears in the KEV catalog. Researcher Juan Alonso reported the flaws to CISA.
Affected Versions
All Kiloview E3 firmware versions before V1.30 are affected.
Patch and Mitigation Steps
- Update E3 firmware to V1.30 from Kiloview’s download page.
- Keep the NDI encoder off the internet.
- Place it behind a firewall, away from business networks.
- Use an up-to-date VPN for remote access.
The CISA ICS advisory ICSA-26-295-01 for the Kiloview E3 lists further guidance. With a shared token secret in play, owners should treat these Kiloview E3 vulnerabilities as urgent and update now.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
