Read the docs
TI-2026-79509 Aliases CVE-2026-110491GHSA-mxp8-hmpp-7pqm

NULL pointer dereference in Kiloview E3 ONVIF service causes denial of service

Priority LOW 37CWE-476Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-476.

Summary

Kiloview E3 Firmware before 1.30 contains a NULL pointer dereference (CWE-476) in its ONVIF service. Sending malformed or incomplete requests to certain operations makes the ONVIF service stop accepting new connections while the rest of the device keeps running. Any unauthenticated remote attacker with network access to the device can trigger this repeatedly, and the service recovers automatically after a period.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected service stops accepting new connections while the rest of the device continues operating normally, and will recover automatically after a period. This can be triggered repeatedly by any unauthenticated party with network access to the device.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00524 44th percentileScored 2026-11-07
Fix Fixed E3 Firmware (Kiloview): 1.30

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
KiloviewE3 Firmwarebefore 1.301.30Patch availableCNA
  • E3 Firmware VendorKiloview Affected before 1.30 Fixed in 1.30 Patch available CNA

Remediation

Update Kiloview E3 Firmware to version 1.30.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA E3 Firmware (Kiloview) Fixed in 1.30

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Kiloview E3 Firmware 1.30

    9 records Highest priority Priority MEDIUM 5 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2026-79510 Missing authentication in Kiloview E3 NDI Encoder ONVIF servicePriority MEDIUM 44
    • TI-2026-79498 Hard-coded credentials in Kiloview E3 NDI Encoder firmware allow forged tokensPriority MEDIUM 44
    • TI-2026-79508 Kiloview E3 NDI Encoder OS Command InjectionPriority MEDIUM 43
    Show all 9 records →

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-110491
  2. 2026-10-23 Affected versions changed · Red Hat
  3. 2026-10-23 CVSS score added · Red Hat
  4. 2026-10-23 Alias added: GHSA-mxp8-hmpp-7pqm
  5. 2026-10-23 CISA SSVC decision points changed
  6. 2026-10-23 Priority changed: MEDIUM → LOW

References

Other 3

  • TI-2025-39367 An issue in KiloView Dual Channel 4k HDMI & 3G-SDI HEVC Video Encoder Firmware… CVSS 3.1HIGH 7.5
  • TI-2024-02008 Use of Hard-coded Credentials in Kiloview NDI N series products API middleware CVSS 3.1CRITICAL 9.8
  • TI-2023-22305 Missing Authentication for Critical Function in Kiloview P1/P2 devices CVSS 3.1CRITICAL 10.0
  • TI-2023-22304 Improper input validation in Kiloview P1/P2 devices allows for remote code execution CVSS 3.1CRITICAL 10.0
  • TI-2026-01150 Missing Authentication for Critical Function in KiloView Encoder Series CVSS 4.0CRITICAL 9.3
  • TI-2023-22307 Authentication Bypass by Primary Weakness in Kiloview P1/P2 devices CVSS 3.1CRITICAL 9.8
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences