CISA flags nine flaws in Kiloview E3 encoder, three giving root on the device
CISA's ICS advisory ICSA-26-295-01 documents nine vulnerabilities in the Kiloview E3 NDI encoder, a video appliance used across the communications and information technology sectors worldwide. Several combine to turn authenticated web access, or in one case none at all, into full root compromise. The only remedy on offer is a firmware update. This runs through what the flaws allow and what network owners should do now.
- All nine vulnerabilities affect Kiloview E3 firmware below 1.30, and the vendor's sole remedy is an update to V1.30.
- CVE-2026-107861 and CVE-2026-110243, both OS command injection flaws, each score 9.9 under CVSS v3.1 and 9.4 under CVSS v4.0, allowing an authenticated web user to execute commands as root.
- CVE-2026-109122, a third command injection flaw, scores 9.1 under CVSS v3.1 and 9.4 under CVSS v4.0, and its malicious configuration persists across reboots.
- CVE-2026-92450 uses an HMAC-SHA256 secret hardcoded identically across all devices, letting an attacker with the public firmware forge administrative session tokens without credentials.
- CISA states no known public exploitation specifically targeting these vulnerabilities has been reported at this time.