Kiloview E3 NDI Encoder IT Security News / 1d The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. The following versions of Kiloview E3 NDI Encoder are affected:
Successful exploitation of this these vulnerabilities could allow an attacker to fully compromise the device.
The following versions of Kiloview E3 NDI Encoder are affected:
E3 Firmware <1.30 (CVE-2026-109122, CVE-2026-111100, CVE-2026-96616, CVE-2026-105265, CVE-2026-110491, CVE-2026-107861, CVE-2026-110243, CVE-2026-92450, CVE-2026-110825)
CVSS Vendor Equipment
v3 9.9 Kiloview E3 Firmware
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Missing Authentication for Critical Function, Insufficient Session Expiration, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), NULL Pointer Dereference, Use of Hard-coded Credentials
Critical Infrastructure Sectors: Communications, Information Technology
Countries/Areas Deployed: Worldwide
Company Headquarters Location: China
Vulnerabilities Expand All +
Kiloview E3 Firmware: <1.30
Product Status: known_affected
Mitigation KiloView recommends users update to V1.30:
Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS Version Base Score Base Severity Vector String
3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
4.0 9.4 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Kiloview E3 Firmware: <1.30
Product Status: known_affected
Mitigation KiloView recommends users update to V1.30:
Kiloview E3 Firmware: <1.30
Product Status: known_affected
Mitigation KiloView recommends users update to V1.30:
Relevant CWE: CWE-306 Missing Authentication for Critical Function
CVSS Version Base Score Base Severity Vector String
3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 6.9 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Kiloview E3 Firmware: <1.30
Product Status: known_affected
Mitigation KiloView recommends users update to V1.30:
Kiloview E3 Firmware: <1.30
Product Status: known_affected
Mitigation KiloView recommends users update to V1.30:
Kiloview E3 Firmware: <1.30
Product Status: known_affected
Mitigation KiloView recommends users update to V1.30:
Relevant CWE: CWE-613 Insufficient Session Expiration
CVSS Version Base Score Base Severity Vector String
3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
4.0 8.3 HIGH CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Kiloview E3 Firmware: <1.30
Product Status: known_affected
Mitigation KiloView recommends users update to V1.30:
Kiloview E3 Firmware: <1.30
Product Status: known_affected
Mitigation KiloView recommends users update
[…] Content was trimmed to protect the source. Please visit the original article for the full text.
Read the original article:
Kiloview E3 NDI Encoder
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
