CVE-2026-107861: Kiloview E3 NDI Encoder OS Command Injection
The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary operating system commands as root, resulting in full device compromise.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kiloview E3 NDI Encoder firmwareto a version that resolves this vulnerability.Fixed in V1.30
Event History
Frequently Asked Questions
Which users could exploit this issue?
An authenticated web user who can access the device naming function is able to supply a crafted hostname value. The provided information does not indicate that unauthenticated users can exploit it.
What level of access could successful exploitation provide?
Injected commands execute as root on the encoder. This can result in complete compromise of the affected device, including confidentiality, integrity, and availability impacts.
What should be reviewed while remediation is being planned?
Identify Kiloview E3 NDI Encoders and review web-user accounts that can access device naming controls. Limit that access to trusted administrators, since use of the hostname parameter is the described exploitation path.
Which firmware versions are affected or fixed?
The supplied information does not identify affected or remediated firmware versions. Verify firmware guidance using the referenced Kiloview firmware download and CISA advisory materials.