CVE-2026-109122Critical· 9.1▾ MidnightThe network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system commands as root, and the malicious configuration persists across reboots. Successful exploitation could result in full device compromise, including exposure of stored credentials and cryptographic material.
e3_firmware < 1.30KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-107861Critical· 9.9Kiloview E3 NDI Encoder OS Command Injection
CVE-2026-110243Critical· 9.9Kiloview E3 NDI Encoder OS Command Injection
CVE-2026-111100Medium· 5.3Kiloview E3 NDI Encoder Missing Authentication for Critical Function
CVE-2026-105265Medium· 5.3Kiloview E3 NDI Encoder Path Traversal
CVE-2026-110491High· 7.5Kiloview E3 NDI Encoder NULL Pointer Dereference
CVE-2026-96616Medium· 6.5Kiloview E3 NDI Encoder Insufficient Session Expiration