CISA has published advisory ICSA-26-295-01 covering nine vulnerabilities in the Kiloview E3 NDI video encoder, including two command injection flaws rated CVSS 9.9 that give an attacker root access. Kiloview fixed all nine in firmware V1.30, and the affected firmware is any version before that.
The Command Injection Flaws That Give Root Access
CVE-2026-107861, rated 9.9, arises because the device passes a hostname unquoted into a shell command. CVE-2026-110243, also 9.9, comes from missing validation of a network interface name. A third injection, CVE-2026-109122, scores 9.1 and involves static route settings; a malicious configuration set through it persists across reboots.
Forgeable Login Tokens in CVE-2026-92450
CVE-2026-92450 is rated 7.5. The device signs login tokens with a secret that is identical on every unit, so anyone who has the public firmware can forge administrator tokens. This weakens the login requirement that would otherwise limit the injection bugs, since an attacker can use a forged token to meet the authentication condition.
Unauthenticated ONVIF Access and Other Weaknesses
CVE-2026-110825 concerns an unauthenticated ONVIF service. It lets anyone change the device’s hostname, DNS and NTP settings without logging in. Changes to the hostname are significant because the hostname feeds into one of the command injection flaws described above.
The remaining vulnerabilities are a user account leak (CVE-2026-111100), a repeated service freeze (CVE-2026-110491), an excessively long token lifetime (CVE-2026-96616) and a time zone path traversal (CVE-2026-105265). Together with the five items already described, they make up the nine in the advisory.
Who Reported the Kiloview Bugs
The vulnerabilities were reported by Juan Alonso. CISA says no public exploitation is known, and none of the nine CVEs is in the Known Exploited Vulnerabilities catalog.
Why Broadcast Encoders Are in Scope
The Kiloview E3 is a video encoder used for NDI, a protocol for sending video over IP networks, in broadcast and live-production settings. A device compromised through these flaws would be under the attacker’s full control, and the advisory describes the exposure as full device compromise of encoders deployed worldwide.
The combination of flaws gives a possible chain, based on the descriptions in the advisory. The unauthenticated ONVIF service can change a hostname, the hardcoded signing secret lets an attacker forge a token, and a command injection through the hostname can then run commands as root. CISA’s advisory lists the individual weaknesses, and the chain is an inference from how they interact rather than a documented attack.
Persistence Through Static Route Settings
The static route flaw, CVE-2026-109122, is distinct because its malicious configuration survives a reboot. A restart of the device therefore would not clear a tampered route setting, which makes persistence a feature of at least one of the injection bugs.
Kiloview Firmware V1.30 Is the Only Listed Remedy
Kiloview’s remedy is firmware V1.30, which addresses all nine vulnerabilities. The advisory does not list a workaround for devices that cannot be updated promptly. Because CISA reports no known public exploitation, the fix and the technical descriptions arrived together on October 22, before any attacks were observed.
The advisory does not state how many Kiloview E3 units are deployed or exposed to the internet. It also does not say whether Kiloview has other encoder models that share the same code, so the E3 with firmware before V1.30 is the only affected product named.
How the Nine CVEs Divide by Severity
Two of the flaws score 9.9, one scores 9.1 and one scores 7.5. The scores for the remaining five, including the unauthenticated ONVIF service, the account leak, the service freeze, the long token lifetime and the time zone path traversal, are not given in the coverage of the advisory.
