Read the docs
TI-2026-79504 Aliases CVE-2026-107861GHSA-f3x3-gqxc-76c6

OS command injection in Kiloview E3 NDI Encoder firmware

Priority MEDIUM 43CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Kiloview E3 NDI Encoder firmware before 1.30 does not sanitize the hostname parameter accepted by its device naming endpoint and passes it unquoted into a shell command. This is an OS command injection flaw (CWE-78). An authenticated web user with access to this function can embed characters that execute arbitrary operating system commands as root, fully compromising the device.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary operating system commands as root, resulting in full device compromise.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00512 43rd percentileScored 2026-11-07
Fix Fixed E3 Firmware (Kiloview): 1.30

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
KiloviewE3 Firmwarebefore 1.301.30Patch availableCNA
  • E3 Firmware VendorKiloview Affected before 1.30 Fixed in 1.30 Patch available CNA

Remediation

Update Kiloview E3 Firmware to version 1.30 or later, which fixes this flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA E3 Firmware (Kiloview) Fixed in 1.30

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Kiloview E3 Firmware 1.30

    9 records Highest priority Priority MEDIUM 5 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2026-79510 Missing authentication in Kiloview E3 NDI Encoder ONVIF servicePriority MEDIUM 44
    • TI-2026-79498 Hard-coded credentials in Kiloview E3 NDI Encoder firmware allow forged tokensPriority MEDIUM 44
    • TI-2026-79508 Kiloview E3 NDI Encoder OS Command InjectionPriority MEDIUM 43
    Show all 9 records →

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-107861
  2. 2026-10-23 Alias added: GHSA-f3x3-gqxc-76c6
  3. 2026-10-23 CISA SSVC decision points changed

References

Other 3

  • TI-2025-39367 An issue in KiloView Dual Channel 4k HDMI & 3G-SDI HEVC Video Encoder Firmware… CVSS 3.1HIGH 7.5
  • TI-2024-02008 Use of Hard-coded Credentials in Kiloview NDI N series products API middleware CVSS 3.1CRITICAL 9.8
  • TI-2023-22305 Missing Authentication for Critical Function in Kiloview P1/P2 devices CVSS 3.1CRITICAL 10.0
  • TI-2023-22304 Improper input validation in Kiloview P1/P2 devices allows for remote code execution CVSS 3.1CRITICAL 10.0
  • TI-2026-01150 Missing Authentication for Critical Function in KiloView Encoder Series CVSS 4.0CRITICAL 9.3
  • TI-2023-22307 Authentication Bypass by Primary Weakness in Kiloview P1/P2 devices CVSS 3.1CRITICAL 9.8
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences