CVE-2026-107861

The Kiloview E3 NDI encoder is vulnerable to an OS command injection flaw within its firmware. The system control service fails to properly sanitize the hostname parameter accepted by the device naming endpoint, which is subsequently passed unquoted into a shell command. An authenticated web user...

CVE-2026-110491 Kiloview E3 NDI Encoder NULL Pointer Dereference

The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected service stops accepting new connections while the rest of the device continues operating normally, and will recover automatically after a period. This can be...

CVE-2026-110491

The Kiloview E3 NDI Encoder is vulnerable to a NULL Pointer Dereference (CWE-476) within its ONVIF service . An unauthenticated party with network access can trigger this by sending malformed or incomplete requests to specific operations, causing the service to stop accepting new connections. Whi...

CVE-2026-105265

The Kiloview E3 NDI Encoder is affected by a path traversal vulnerability (CWE-22) within its time zone parameter . Due to improper validation of user input, an authenticated user may cause the /etc/localtime file to point to a location outside the intended zoneinfo directory . The vulnerability ...

CVE-2026-105265 Kiloview E3 NDI Encoder Path Traversal

A vulnerability exists in the the time zone parameter and does not properly validate user input, which may allow an authenticated user to cause /etc/localtime to point to a file outside the intended zoneinfo directory...

CVE-2026-96616 Kiloview E3 NDI Encoder Insufficient Session Expiration

Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them non-expiring. A token obtained through interception or device compromise remains valid for authenticated access for an extend...

CVE-2026-96616

The Kiloview E3 NDI Encoder is vulnerable to Insufficient Session Expiration (CWE-613) within its web management interface. The root cause is that authentication tokens issued upon login are configured with an expiration time so extended that they effectively become non-expiring . If an attacker ...

CVE-2026-111100 Kiloview E3 NDI Encoder Missing Authentication for Critical Function

The ONVIF device service on the E3 responds to certain informational requests without requiring authentication. A remote, unauthenticated party can retrieve detailed device identifiers along with a list of configured user accounts and their privilege levels. This aids attackers in fingerprinting...

CVE-2026-111100

The Kiloview E3 NDI Encoder is impacted by a missing authentication vulnerability in its ONVIF device service . A remote, unauthenticated party can send specific informational requests to retrieve detailed device identifiers and a list of configured user accounts including their privilege levels....

CVE-2026-109122

The Kiloview E3 NDI encoder firmware contains an OS Command Injection vulnerability in its network management service. The service fails to properly sanitize a field used when configuring static routes via the web management API. An authenticated web user with permission to configure static route...

CVE-2026-109122 Kiloview E3 NDI Encoder OS Command Injection

The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system...

Kiloview E3 NDI Encoder

ADVISORY SUMMARY Successful exploitation of this these vulnerabilities could allow an attacker to fully compromise the device. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all...

PT-2026-121683

The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform the same validation. An authenticated...

PT-2026-121682

The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary...

CVE-2026-1453

A missing authentication for critical function vulnerability in KiloView Encoder Series could allow an unauthenticated attacker to create or delete administrator accounts. This vulnerability can grant the attacker full administrative control over the product...

CVE-2026-1453

A missing authentication for critical function vulnerability in KiloView Encoder Series could allow an unauthenticated attacker to create or delete administrator accounts. This vulnerability can grant the attacker full administrative control over the product...

CVE-2026-1453

CVE-2026-1453 affects the KiloView Encoder Series. The issue is a missing authentication for a critical function that allows an unauthenticated attacker to create or delete administrator accounts, granting full administrative control over the product. Public sources (NVD/Red Hat/CISA/EUVD/PT-Secu...

CVE-2026-1453 Missing Authentication for Critical Function in KiloView Encoder Series

A missing authentication for critical function vulnerability in KiloView Encoder Series could allow an unauthenticated attacker to create or delete administrator accounts. This vulnerability can grant the attacker full administrative control over the product...

CVE-2026-1453

A missing authentication for critical function vulnerability in KiloView Encoder Series could allow an unauthenticated attacker to create or delete administrator accounts. This vulnerability can grant the attacker full administrative control over the product...

CVE-2026-1453 Missing Authentication for Critical Function in KiloView Encoder Series

A missing authentication for critical function vulnerability in KiloView Encoder Series could allow an unauthenticated attacker to create or delete administrator accounts. This vulnerability can grant the attacker full administrative control over the product...