---
id: CVE-2026-110825
title: Kiloview E3 NDI Encoder Missing Authentication for Critical Function
summary: >-
  The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts
  hostname, DNS, and NTP configuration write operations without requiring
  authentication, regardless of the device's configured authentication setting
  for this s…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-306
vendor: Kiloview
product: E3 Firmware
affected:
  - e3_firmware < 1.30
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T22:11:55.815Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110825'
references:
  - url: 'https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/'
  - url: 'https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01'
  - url: >-
      https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-01.json
tags:
  - cve.org
ingestedAt: '2026-10-22T23:08:45.759Z'
---

## Overview

The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this service. A remote, unauthenticated attacker can alter the device hostname, redirect DNS resolution, or modify the configured time source, enabling follow on attacks such as traffic interception or certificate validation bypass.

## Affected

- `e3_firmware < 1.30`

## Remediation

KiloView recommends users update to V1.30:  https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/