Kiloview E3 Firmware: Insufficient session expiration in web management

Summary

Authentication tokens issued by the web management interface of the Kiloview E3 NDI encoder firmware on login get an expiration time far beyond any reasonable session lifetime, so they effectively do not expire. An attacker who obtains a token through interception or device compromise can keep authenticated access to the device for an extended period. The attack is network-based and needs no privileges, but it has high complexity and requires a token to be obtained first. This CVE is part of CISA advisory ICSA-26-295-01, which covers nine CVEs in the same firmware.

Affected

• Kiloview E3 Firmware: versions before 1.30

Fixed in

• Firmware 1.30 (per vendor)

Workaround

• Unknown. No workaround is documented for this CVE; apply the update to 1.30.
• Until patched, restrict access to the web interface to trusted networks.

Exploitation

• Unclear: sources conflict on whether this CVE is listed in the CISA KEV catalog; check the catalog directly.
• No public proof-of-concept code found.

Our recommendation

• Update to firmware 1.30 or later.
• Remove internet exposure of the web interface and restrict access to trusted networks.
• If a device may have been exposed, rotate its credentials and review logins for unknown access.
• Plan the update together with the other CVEs in ICSA-26-295-01.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CISA ICS Advisory ICSA-26-295-01 www.cisa.gov
• CISA CSAF file ICSA-26-295-01 github.com
• Kiloview firmware download (vendor) www.kiloview.com
• VulDB CVE-2026-96616 vuldb.com
• SecurityOnline: Kiloview E3 vulnerabilities securityonline.info

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:18.