Kiloview E3 Firmware: OS command injection via static route configuration
Summary
The network management service of the Kiloview E3 NDI encoder firmware does not sanitize a field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can execute arbitrary operating system commands as root, and the malicious configuration persists across reboots. Successful exploitation could lead to full device compromise, including exposure of stored credentials and cryptographic material.
Affected
- Kiloview E3 NDI encoder, firmware versions below 1.30 (CISA: <1.30)
Fixed in
- Firmware version 1.30 (per vendor and CISA)
Workaround
Unknown.
Exploitation
- No public exploit known at the time of research (VulDB: no exploit available).
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Not listed in CISA KEV according to a third-party tracker.
Our recommendation
- Inventory all Kiloview E3 units and record the firmware version of each device.
- Update all units below 1.30 to version 1.30.
- Remove internet exposure of the web interface and ONVIF services.
- Review accounts with static-route permissions, remove unneeded accounts and rotate credentials.
- After patching, check the device for unexpected static routes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CISA ICS Advisory ICSA-26-295-01 www.cisa.gov
- CSAF document ICSA-26-295-01 (GitHub) github.com
- Kiloview E3 firmware download 1.30 www.kiloview.com
- VulDB CVE-2026-109122 vuldb.com
- Vulners VulnRichment CVE-2026-109122 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:54.
Original description (NVD)
The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system commands as root, and the malicious configuration persists across reboots. Successful exploitation could result in full device compromise, including exposure of stored credentials and cryptographic material.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.