Read the docs
TI-2026-79506 Aliases CVE-2026-109122GHSA-f5fq-95vg-f6g7

OS command injection in Kiloview E3 NDI Encoder firmware

Priority MEDIUM 43CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Kiloview E3 firmware from 0 before 1.30 is affected. The network management service fails to sanitize one field used when configuring static routes through the web management API, which is an OS command injection (CWE-78). An authenticated web user who may configure static routes can run arbitrary operating system commands as root, and the malicious configuration persists across reboots. Successful exploitation could lead to full device compromise, including stored credentials and cryptographic material.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system commands as root, and the malicious configuration persists across reboots. Successful exploitation could result in full device compromise, including exposure of stored credentials and cryptographic material.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00522 44th percentileScored 2026-11-07
Fix Fixed E3 Firmware (Kiloview): 1.30

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
KiloviewE3 Firmwarebefore 1.301.30Patch availableCNA
  • E3 Firmware VendorKiloview Affected before 1.30 Fixed in 1.30 Patch available CNA

Remediation

Upgrade Kiloview E3 Firmware to version 1.30, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA E3 Firmware (Kiloview) Fixed in 1.30

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Kiloview E3 Firmware 1.30

    9 records Highest priority Priority MEDIUM 5 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2026-79510 Missing authentication in Kiloview E3 NDI Encoder ONVIF servicePriority MEDIUM 44
    • TI-2026-79498 Hard-coded credentials in Kiloview E3 NDI Encoder firmware allow forged tokensPriority MEDIUM 44
    • TI-2026-79508 Kiloview E3 NDI Encoder OS Command InjectionPriority MEDIUM 43
    Show all 9 records →

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-109122
  2. 2026-10-23 Alias added: GHSA-f5fq-95vg-f6g7
  3. 2026-10-23 CISA SSVC decision points changed

References

Other 3

  • TI-2025-39367 An issue in KiloView Dual Channel 4k HDMI & 3G-SDI HEVC Video Encoder Firmware… CVSS 3.1HIGH 7.5
  • TI-2024-02008 Use of Hard-coded Credentials in Kiloview NDI N series products API middleware CVSS 3.1CRITICAL 9.8
  • TI-2023-22305 Missing Authentication for Critical Function in Kiloview P1/P2 devices CVSS 3.1CRITICAL 10.0
  • TI-2023-22304 Improper input validation in Kiloview P1/P2 devices allows for remote code execution CVSS 3.1CRITICAL 10.0
  • TI-2026-01150 Missing Authentication for Critical Function in KiloView Encoder Series CVSS 4.0CRITICAL 9.3
  • TI-2023-22307 Authentication Bypass by Primary Weakness in Kiloview P1/P2 devices CVSS 3.1CRITICAL 9.8
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences