Command Injection Vulnerability in Kiloview E3 NDI Encoder Firmware
CVE-2026-110243

9.4CRITICAL

Key Information:

Vendor

Kiloview

Status
E3 Firmware
Vendor
CVE Published:
22 October 2026

What is CVE-2026-110243?

The Kiloview E3 NDI encoder firmware contains a command injection vulnerability in its network management service. Specifically, the firmware does not properly validate the network interface name input at its link maintenance address configuration endpoint. This lapse allows an authenticated user with the necessary permissions to potentially execute arbitrary operating system commands with root privileges. Unlike similar handlers which implement proper validation checks, this vulnerability poses a significant risk if exploited, making it crucial for users to update their firmware.

Affected Version(s)

E3 Firmware 0 < 1.30

E3 Firmware 1.30

References

https://www.kiloview.com/en/download/e3-firmware-download...
https://www.cisa.gov/news-events/ics-advisories/icsa-26-2...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Juan Alonso reported this vulnerability to CISA.
.