CVE-2026-110825High· 7.5▾ TwilightThe ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this s…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this service. A remote, unauthenticated attacker can alter the device hostname, redirect DNS resolution, or modify the configured time source, enabling follow on attacks such as traffic interception or certificate validation bypass.
e3_firmware < 1.30KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111100Medium· 5.3Kiloview E3 NDI Encoder Missing Authentication for Critical Function
CVE-2026-105265Medium· 5.3Kiloview E3 NDI Encoder Path Traversal
CVE-2026-110491High· 7.5Kiloview E3 NDI Encoder NULL Pointer Dereference
CVE-2026-96616Medium· 6.5Kiloview E3 NDI Encoder Insufficient Session Expiration
CVE-2026-92450High· 7.5Kiloview E3 NDI Encoder Use of Hard-coded Credentials
CVE-2026-107861Critical· 9.9Kiloview E3 NDI Encoder OS Command Injection