CVE-2026-111100: Kiloview E3 NDI Encoder Missing Authentication for Critical Function
Published Oct 22, 2026
·Updated
The ONVIF device service on the E3 responds to certain informational requests without requiring authentication. A remote, unauthenticated party can retrieve detailed device identifiers along with a list of configured user accounts and their privilege levels. This aids attackers in fingerprinting vulnerable devices and preparing targeted credential attacks.
Affected Software
1 affected component
Kiloview E3 NDI Encoder
Remediation
Information
KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/
Event History
Oct 22, 2026
CVE Published
via MITRE·09:53 PM
Data Sourced
via MITRE·09:53 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What information can an unauthenticated remote attacker obtain?
The attacker can retrieve detailed device identifiers and a list of configured user accounts with their privilege levels through certain ONVIF device-service informational requests.
2
Does exploitation require credentials or user interaction?
No. The issue is reachable remotely and can be exploited without authentication or user interaction.
3
What should affected operators do?
Update the Kiloview E3 NDI Encoder firmware to V1.30, as recommended by KiloView.