Kiloview E3 NDI Encoder: Missing authentication for critical function in ONVIF service
Summary
The ONVIF device service of the Kiloview E3 NDI encoder accepts changes to hostname, DNS and NTP settings without authentication, regardless of the configured authentication setting. A remote, unauthenticated attacker can alter these settings, for example to redirect DNS resolution or change the time source. This can enable follow-on attacks such as traffic interception or certificate validation bypass.
Affected
- Kiloview E3 NDI encoder firmware before 1.30 (CVE record range: 0 to less than 1.30)
Fixed in
- Firmware version 1.30 (released 2026-10-10 according to the vendor download page)
- Vendor confirmation that 1.30 fixes this specific CVE is still open
Workaround
Unknown. No vendor or CISA workaround is documented; CISA points to the firmware update.
Exploitation
- No evidence of exploitation in the wild found in the sources.
- No public proof-of-concept known.
- CISA SSVC: Exploitation none, Automatable yes, Technical impact partial.
- Not verified in the CISA KEV catalogue.
Our recommendation
- Update all Kiloview E3 devices to firmware 1.30 or later, and verify the version after the upgrade.
- Apply the update to the whole advisory ICSA-26-295-01, since other CVEs affect the same product.
- Prioritise devices reachable from the internet or untrusted networks; patch isolated devices in the next maintenance window.
- Isolate the encoder on a management VLAN, restrict ONVIF and web access to known hosts, and make sure there is no public port forwarding.
- Monitor for unexpected changes to hostname, DNS or NTP settings.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CISA ICS Advisory ICSA-26-295-01 www.cisa.gov
- CISA CSAF file ICSA-26-295-01 github.com
- Kiloview E3 firmware download page www.kiloview.com
- VulDB entry 425541 vuldb.com
- Vulners VulnRichment CVE-2026-110825 vulners.com
- Strix CVE-2026-110825 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:35.
Original description (NVD)
The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this service. A remote, unauthenticated attacker can alter the device hostname, redirect DNS resolution, or modify the configured time source, enabling follow on attacks such as traffic interception or certificate validation bypass.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.