Kiloview E3 firmware before 1.30 allows root command injection
Nine CVEs affect firmware before 1.30, including unauthenticated ONVIF leaks and a denial of service; KiloView's fix is V1.30.
66
CVE-2026-109122
Authenticated OS command injection in Kiloview E3 encoder
- CVSS 4.0
- 9.4 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
The network management service on Kiloview E3 NDI encoder firmware does not sanitize a field used when configuring static routes through the web management API. An authenticated web user who can set static routes can run arbitrary operating system commands as root. The malicious configuration survives reboots and can fully compromise the device, including stored credentials and cryptographic material.
What to do: Apply Kiloview's update for CVE-2026-109122. No fixed version or workaround is stated.
| Product | Affected |
|---|---|
| Kiloview E3 NDI encoder firmware | — |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system commands as root, and the malicious configuration persists across reboots. Successful exploitation could result in full device compromise, including exposure of stored credentials and cryptographic material.
- Weakness
- CWE-78
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X