Remote Code Execution Vulnerability in Kiloview E3 NDI Encoder Firmware
CVE-2026-109122

9.4CRITICAL

Key Information:

Vendor

Kiloview

Status
E3 Firmware
Vendor
CVE Published:
22 October 2026

What is CVE-2026-109122?

The firmware for the Kiloview E3 NDI encoder presents a significant security flaw in its network management service. This vulnerability allows an authenticated user to execute arbitrary operating system commands as root, due to improper sanitization of a field during static route configuration via the web management API. Malicious configurations implemented can persist after firmware reboots, potentially leading to total device compromise that exposes sensitive stored credentials and cryptographic materials, posing a substantial risk to network integrity.

Affected Version(s)

E3 Firmware 0 < 1.30

E3 Firmware 1.30

References

https://www.kiloview.com/en/download/e3-firmware-download...
https://www.cisa.gov/news-events/ics-advisories/icsa-26-2...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Juan Alonso reported this vulnerability to CISA.
.