Multiple Critical Vulnerabilities Discovered in Kiloview E3 NDI Encoder
CISA has issued an advisory detailing multiple critical vulnerabilities in Kiloview E3 NDI Encoder firmware versions prior to 1.30, with potential for full device compromise.
CISA has alerted users to a series of critical vulnerabilities affecting the Kiloview E3 NDI Encoder, specifically impacting firmware versions earlier than 1.30. These flaws, if successfully exploited, could grant attackers complete control over the affected devices, posing a significant risk to industrial control systems and broadcast infrastructure.
The most severe among these is CVE-2026-109122, an OS command injection vulnerability. This flaw allows an authenticated user with web management API access to execute arbitrary operating system commands with root privileges. The malicious configuration persists across device reboots, enabling persistent compromise and potentially leading to the exposure of sensitive credentials and cryptographic material.
Another significant vulnerability, CVE-2026-111100, affects the ONVIF device service. This flaw permits unauthenticated remote attackers to retrieve detailed device identifiers and a list of configured user accounts, including their privilege levels. This information can be invaluable for attackers seeking to fingerprint vulnerable devices and plan more targeted attacks.
Further compounding the security concerns are issues related to session management and path traversal. CVE-2026-96616 describes insufficient session expiration, where authentication tokens are issued with excessively long lifespans, effectively making them non-expiring. This means a token obtained through interception or compromise could remain valid for an extended period, facilitating prolonged unauthorized access.
Additionally, CVE-2026-105265 highlights a path traversal vulnerability. This flaw arises from improper validation of user input for the time zone parameter, potentially allowing an authenticated user to manipulate the system to point /etc/localtime to files outside the intended zoneinfo directory. This could lead to unexpected system behavior or further exploitation opportunities.
Other identified vulnerabilities include NULL pointer dereferences, use of hard-coded credentials, and denial-of-service conditions. CVE-2026-110491, for instance, details how malformed requests to the ONVIF service can render it unresponsive, preventing new connections while the rest of the device continues to operate. These issues, while potentially less severe individually, contribute to a broader attack surface.
Kiloview has released firmware version 1.30 to address these vulnerabilities. Users are strongly advised to update their E3 NDI Encoder devices to the latest firmware as soon as possible to mitigate the risks. The advisory emphasizes that successful exploitation of these flaws can lead to full device compromise, impacting critical infrastructure sectors such as communications and information technology worldwide.
The affected devices are deployed globally, and the vulnerabilities carry high CVSS scores, with CVE-2026-109122 rated as CRITICAL with a base score of 9.1. The combination of command injection, information disclosure, and session management flaws presents a serious threat that requires immediate attention from administrators and security teams managing these devices.