CISA flags nine Kiloview E3 vulnerabilities allowing root-level device access
CISA has issued an advisory regarding nine vulnerabilities in the Kiloview E3 NDI encoder, including critical command injection flaws that could allow root-level access. Users are urged to update to firmware V1.30 to address these security risks, which include shared secret vulnerabilities and unauthenticated ONVIF flaws.
Key Takeaways
- Two command injection flaws, CVE-2026-107861 and CVE-2026-110243, received critical CVSS scores of 9.9.
- Firmware V1.30 has been released to patch all nine identified security risks.
- A shared secret in the firmware allows attackers to forge login tokens for any device running affected software.
- Unauthenticated ONVIF flaws permit unauthorized changes to DNS, NTP, and hostname settings.
- CISA recommends isolating NDI encoders from the internet and placing them behind firewalls.
Why It Matters
The discovery of root-level flaws in widely deployed NDI encoders highlights a significant security gap in live production hardware. Because these devices are often integrated into core broadcast networks, a full compromise allows attackers to intercept traffic or disrupt live streams at the source. This incident underscores the risk of using static shared secrets across hardware fleets, a practice that simplifies administrative access but creates a single point of failure for the entire product line. Moving forward, streaming professionals should monitor whether CISA adds these CVEs to the Known Exploited Vulnerabilities catalog, which would signal active targeting of broadcast infrastructure.
Additional Context
For those managing complex IP-based live production environments, this vulnerability serves as a reminder to prioritize network segmentation and regular firmware audits. To further enhance visibility into these workflows, teams should consider real-time monitoring for IP workflows to detect unauthorized access attempts.
Companies in this story
In short
CISA has issued an urgent advisory regarding nine vulnerabilities in Kiloview E3 NDI encoders, including critical command injection flaws. These security gaps allow attackers to gain root-level access and forge administrative tokens. This matters because compromised encoders can lead to intercepted traffic or disrupted live streams within core broadcast networks.
FAQ
What are the risks associated with the Kiloview E3 vulnerabilities?
The vulnerabilities include critical command injection risks and a shared secret flaw that allows attackers to forge administrative session tokens, potentially granting them full root-level control over the device.
How can users patch the Kiloview E3 security flaws?
Kiloview has released firmware version V1.30, which addresses and patches all nine of the identified security vulnerabilities.
What does CISA recommend to protect NDI encoders?
CISA recommends that users isolate their NDI encoders from the internet and ensure they are placed behind firewalls to prevent unauthorized access.
What are the specific CVEs mentioned for the command injection flaws?
The two command injection flaws identified in the advisory are CVE-2026-107861 and CVE-2026-110243, both of which received critical CVSS scores of 9.9.
Read full article at securityonline.info
Enjoy our coverage?
Add StreamingMeme as a preferred source on Google to see more of our streaming news at the top of your Search results.
Add as preferred source
