Skip to content
Critical Vulnerabilities in Kiloview E3 NDI Encoder Exposed

Critical Vulnerabilities in Kiloview E3 NDI Encoder Exposed

First seen 24 Oct 2026, 17:42 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 24, 2026 at 18:43 UTC
  • •Two critical command injection vulnerabilities (CVSS 9.9) allow root access.
  • •Affected versions are Kiloview E3 firmware below 1.30; update is strongly recommended.
  • •No evidence of active exploitation or public proof-of-concept code currently exists.

CISA has issued an advisory detailing nine vulnerabilities in the Kiloview E3 NDI Encoder, with two command injection flaws rated CVSS 9.9, allowing attackers to execute arbitrary commands as root. The affected firmware versions are those below 1.30, and the vulnerabilities include CVE-2026-110243 and CVE-2026-107861. These flaws arise from improper validation of inputs, enabling unauthorized command execution. The vulnerabilities impact critical infrastructure sectors such as communications and information technology. Kiloview recommends users update to firmware version 1.30 to mitigate these risks. As of now, there is no evidence of or public proof-of-concept code. The advisory emphasizes the need for restricted access to the network management service and its configuration endpoints.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-22
CISA publishes advisory ICSA-26-295-01
CISA details nine vulnerabilities in Kiloview E3 NDI Encoder, including critical command injection flaws.
Cisa
2026-10-22
CVE-2026-110243 published
CVE-2026-110243, a critical command injection vulnerability, is disclosed with a CVSS score of 9.9.
Feedly
2026-10-22
CVE-2026-107861 published
CVE-2026-107861, another critical command injection vulnerability, is also disclosed with a CVSS score of 9.9.
dailysecurityreview.com
2026-10-22
CVE-2026-111100 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-22
CVE-2026-110825 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-22
CVE-2026-96616 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-22
CVE-2026-105265 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-22
CVE-2026-109122 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-22
CVE-2026-92450 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-22
CVE-2026-110491 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (6)

Following this threat?

Track Kiloview and CVE-2026-105265 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (21)

1 / 4

Common questions

Which versions of Kiloview E3 are affected?
All Kiloview E3 NDI Encoder firmware versions below 1.30 are affected.
What should I do if I am using the affected firmware?
Update to firmware version 1.30 or later to mitigate the vulnerabilities.
Is there any evidence of exploitation?
Currently, there is no evidence of active exploitation or public proof-of-concept code.