Kiloview E3 NDI Encoder: OS command injection in link maintenance configuration
Summary
Firmware versions below 1.30 of the Kiloview E3 NDI encoder fail to validate the network interface name in the link maintenance address configuration endpoint before it is passed to a shell command. An authenticated web user with permission to change network settings can execute arbitrary operating system commands as root, which can lead to full device compromise. The NVD record is still deferred, and the CVSS scores (v4.0 9.4 in the CVE data, v3.1 9.9 from the CNA) are both critical. The CISA advisory ICSA-26-295-01 covers eight further flaws in the same firmware, so the update should be applied to all of them.
Affected
- Kiloview E3 NDI Encoder firmware below 1.30 (CISA: <1.30)
Fixed in
- Firmware 1.30 (KiloView recommends updating to V1.30)
Workaround
- No vendor-documented setting disables the affected endpoint.
- Until the update is applied, restrict who holds network configuration rights in the web interface and review user accounts.
- Keep the device off the internet and place it on a dedicated management VLAN.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Not known to be exploited; the sources reviewed do not list it as known exploited.
- No public proof of concept found for this CVE; status unknown.
Our recommendation
- Inventory all Kiloview E3 units and their firmware versions.
- Update affected units to firmware 1.30 as soon as possible.
- Remove any internet exposure of the web interface and restrict management access to administrators on a trusted network.
- Review user accounts with network configuration rights and monitor devices for unexpected changes.
- Verify the affected endpoint description against the CISA CSAF file, as the excerpts reviewed do not confirm it.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CISA ICS Advisory ICSA-26-295-01 www.cisa.gov
- CISA CSAF file ICSA-26-295-01 (GitHub) github.com
- Kiloview E3 firmware download www.kiloview.com
- VulDB CVE-2026-110243 vuldb.com
- Hol.org CVE-2026-110243 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:53.
Original description (NVD)
The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform the same validation. An authenticated web user with permission to configure network settings can exploit this to execute arbitrary operating system commands as root.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.