Command Injection Vulnerability in Kiloview E3 NDI Encoder Firmware
CVE-2026-107861

9.4CRITICAL

Key Information:

Vendor

Kiloview

Status
E3 Firmware
Vendor
CVE Published:
22 October 2026

What is CVE-2026-107861?

The Kiloview E3 NDI encoder firmware contains a command injection vulnerability due to improper handling of the hostname parameter in its device naming endpoint. An authenticated user can exploit this flaw by embedding special characters, allowing for execution of arbitrary commands with root privileges. This critical security issue could lead to total compromise of the device, making it essential for users to update to the latest firmware release.

Affected Version(s)

E3 Firmware 0 < 1.30

E3 Firmware 1.30

References

https://www.kiloview.com/en/download/e3-firmware-download...
https://www.cisa.gov/news-events/ics-advisories/icsa-26-2...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Juan Alonso reported this vulnerability to CISA.
.