Nine Vulnerabilities Discovered in Kiloview E3 NDI Encoder Firmware

A coordinated advisory from CISA and Kiloview highlights nine vulnerabilities in the Kiloview E3 NDI Encoder firmware. The affected versions are all those below 1.30. The most critical flaw, tracked as CVE-2026-109122, is an OS command injection vulnerability in the network management service. An authenticated attacker with permission to configure static routes can execute arbitrary operating system commands as root, and the malicious configuration persists across reboots. CVSS 3.1: 9.1 (CRITICAL).

Other notable issues include CVE-2026-111100, which allows a remote, unauthenticated party to retrieve device identifiers and a list of configured user accounts and privilege levels via the ONVIF device service, aiding targeted credential attacks. CVSS 3.1: 5.3 (MEDIUM). CVE-2026-96616 stems from insufficient session expiration, where login authentication tokens are given expiration times far beyond reasonable session lifetimes, effectively making them non-expiring. CVSS 4.0: 8.3 (HIGH).

The remaining vulnerabilities include path traversal, NULL pointer dereference, and use of hard-coded credentials. Kiloview recommends all users immediately update to firmware version 1.30, available from the official download portal, which addresses all tracked CVEs.