CVE-2026-92450: Kiloview E3 NDI Encoder Use of Hard-coded Credentials
The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to the publicly distributed firmware can recover this secret and forge arbitrary session tokens, including administrative tokens, without valid credentials, enabling unauthenticated access to privileged device functions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kiloview E3 NDI Encoder firmwareto a version that resolves this vulnerability.Fixed in V1.30
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs access to the publicly distributed firmware image to recover the static HMAC-SHA256 secret. They can then forge arbitrary session JWTs, including administrative tokens, without possessing valid device credentials.
Are deployments exposed by default?
The secret is hardcoded in the firmware and identical across deployed devices, so any affected device using this authentication framework is exposed. Exploitation does not require prior authentication or user interaction.
What level of access could successful exploitation provide?
An attacker can create administrative session tokens and obtain unauthenticated access to privileged device functions. The provided impact information indicates high confidentiality impact, with no stated integrity or availability impact.