Authentication Bypass in E3 ONVIF Device Service
CVE-2026-111100

6.9MEDIUM

Key Information:

Vendor

Kiloview

Status
E3 Firmware
Vendor
CVE Published:
22 October 2026

What is CVE-2026-111100?

The ONVIF device service on the E3 device exposes sensitive information without requiring authentication, enabling remote, unauthenticated adversaries to access intricate device identifiers and a roster of configured user accounts along with their associated privilege levels. This vulnerability can be exploited to assist attackers in fingerprinting devices and setting the stage for focused credential attacks, significantly elevating the risk of unauthorized access.

Affected Version(s)

E3 Firmware 0 < 1.30

E3 Firmware 1.30

References

https://www.kiloview.com/en/download/e3-firmware-download...
https://www.cisa.gov/news-events/ics-advisories/icsa-26-2...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Juan Alonso reported this vulnerability to CISA.
.