Kiloview E3 NDI Encoder

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-01.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of this these vulnerabilities could allow an attacker to fully compromise the device.</strong></p> <p>The following versions of Kiloview E3 NDI Encoder are affected:</p> <ul> <li>E3 Firmware &lt;1.30 (CVE-2026-109122, CVE-2026-111100, CVE-2026-96616, CVE-2026-105265, CVE-2026-110491, CVE-2026-107861, CVE-2026-110243, CVE-2026-92450, CVE-2026-110825)</li> </ul> <div class="csaf-table"> <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap> <thead> <tr> <th role="columnheader" data-tablesaw-priority="persist">CVSS</th> <th role="columnheader">Vendor</th> <th role="columnheader">Equipment</th> </tr> </thead> <tbody> <tr> <td>v3 9.9</td> <td>Kiloview</td> <td>E3 Firmware</td> </tr> </tbody> </table> <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap> <thead> <tr> <th role="columnheader" data-tablesaw-priority="persist">6 Vulnerabilities</th> </tr> </thead> <tbody> <tr> <td>Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Missing Authentication for Critical Function, Insufficient Session Expiration, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), NULL Pointer Dereference, Use of Hard-coded Credentials</td> </tr> </tbody> </table> </div> <h3>Background</h3> <ul> <li><strong>Critical Infrastructure Sectors: </strong>Communications, Information Technology</li> <li><strong>Countries/Areas Deployed: </strong>Worldwide</li> <li><strong>Company Headquarters Location: </strong>China</li> </ul> <hr> <h2>Vulnerabilities</h2> <div class="icsa-etb-toggle-wrapper"><a class="icsa-etb-toggle-all" href="#">Expand All +</a></div> <div class="c-expandable-textbox icsa-etb"> <div class="c-expandable-textbox__title">CVE-2026-109122</div> <div class="c-expandabl