CISA published an advisory on October 22, 2026 covering nine vulnerabilities in the Kiloview E3 NDI Encoder, all affecting E3 firmware versions below 1.30. The list includes CVE-2026-92450, CVE-2026-96616, CVE-2026-105265, CVE-2026-107861, CVE-2026-109122, CVE-2026-110243, CVE-2026-110491, CVE-2026-110825 and CVE-2026-111100. Two of them, CVE-2026-107861 and CVE-2026-110243, carry a CVSS v3 base score of 9.9.

The E3 is a small hardware encoder that takes a video signal from a camera or switcher and converts it into an IP stream using NDI. If your organization runs a broadcast control room, a worship auditorium, a lecture capture setup, a corporate townhall studio or any live production rig, there is a reasonable chance one of these boxes is sitting on a rack somewhere, powered on and rarely touched. CISA lists the affected sectors as Communications and Information Technology, with deployment worldwide and the vendor headquartered in China.

What makes a cluster of nine flaws in a single appliance worth your attention is the range of what they cover. The set spans OS command injection (CWE-78), missing authentication on critical functions (CWE-306), hard-coded credentials (CWE-798), path traversal (CWE-22), insufficient session expiration (CWE-613) and a NULL pointer dereference (CWE-476).

Kiloview has released firmware V1.30, and the vendor's remediation guidance for every one of the nine CVEs points to that same update. Juan Alonso reported the vulnerabilities to CISA.

One detail worth holding onto as you plan: CISA states that no known public exploitation specifically targeting these vulnerabilities has been reported at this time. That is the status as of the initial publication, and it describes reporting to date rather than a guarantee about future activity.

Vulnerability Classes and Exploitation Paths

The nine flaws fall into six weakness classes, and the ones that matter most are the three OS command injection bugs (CWE-78) in the device's own management services. CVE-2026-107861 sits in the system control service, where the hostname parameter accepted by the device naming endpoint is passed unquoted into a shell command. CVE-2026-110243 sits in the network management service, where the interface name taken by the link maintenance address configuration endpoint skips the validation that sibling handlers in the same service perform. Both execute as root.

The third, CVE-2026-109122, abuses an unsanitized field in the static route configuration API and carries CVSS v3 9.1 and CVSS v4 9.4. CISA notes the malicious configuration persists across reboots, which means a power cycle or a maintenance window does not clear the attacker's foothold. Full compromise here includes exposure of stored credentials and cryptographic material held on the device.

The authentication weaknesses are what make those injection bugs reachable. CVE-2026-92450 (CWE-798, CVSS v3 7.5 / v4 8.7) is the pivot: session JSON Web Tokens are signed with an HMAC-SHA256 secret hardcoded as a static string inside the firmware image and identical on every deployed unit. Anyone who downloads the public firmware can extract that secret and mint administrative tokens without ever knowing a password.

That single flaw collapses the privilege preconditions on the command injection set. CVE-2026-107861 and CVE-2026-110243 both require PR:L, and CVE-2026-109122 requires PR:H, but a forged admin JWT satisfies either. Mapped to ATT&CK, the chain reads as T1190 (exploit public-facing application) into T1606 (forge web credentials) into T1059 (command and scripting interpreter) with root-level execution on an embedded Linux host.

Two missing-authentication issues (CWE-306) sit in the ONVIF device service. CVE-2026-111100 (v3 5.3 / v4 6.9) returns device identifiers plus a list of configured user accounts and their privilege levels to any unauthenticated caller, giving attackers a target list for credential attacks. CVE-2026-110825 (v3 7.5 / v4 8.7) accepts hostname, DNS and NTP write operations without authentication regardless of how the service's authentication setting is configured. Redirected DNS and a shifted clock support traffic interception and certificate validation bypass, so a stream you believe is going to an internal destination can be pointed elsewhere.

The remaining three are lower-impact but extend attacker dwell time:

• CVE-2026-96616 (CWE-613, v3 6.5 / v4 8.3): web interface tokens are issued with expiration times far beyond any reasonable session lifetime, so an intercepted token stays usable for an extended period.
• CVE-2026-105265 (CWE-22, v3 5.3 / v4 6.0): the time zone parameter lets an authenticated user point /etc/localtime at a file outside the intended zoneinfo directory.
• CVE-2026-110491 (CWE-476, v3 7.5 / v4 6.9): malformed ONVIF requests stop the service accepting new connections while the rest of the device keeps running, and any unauthenticated party on the network can repeat it.

Every path requires network reachability to the web management API or the ONVIF service. Internet exposure widens the attack surface, though an attacker already on the same production VLAN meets the precondition without it. CISA reports no known public exploitation targeting these vulnerabilities at the time of publication, and the advisory publishes no proof-of-concept code, exploit artifacts or indicators of compromise. Juan Alonso reported the set to CISA.

What a Compromised Encoder Means for Broadcast and AV Operations

Root access on an encoder gives an attacker control of the video path itself. That means your live stream can be stopped mid-broadcast, redirected to a different destination, or replaced with content you did not approve, and the change survives a reboot because it lives in the device configuration rather than in volatile memory.

Think about what runs through these boxes. A city council meeting, a court proceeding, a quarterly earnings call, a hospital grand rounds session, a Sunday service. If an attacker holds root on the encoder handling that feed, they can copy the stream to a destination of their choosing while the legitimate output continues normally. Nobody watching the official feed sees a difference, which is the point.

CVE-2026-110491 shows a quieter version of the same problem. An unauthenticated party on the network can make the ONVIF service stop accepting connections by sending malformed requests, and they can repeat it. The rest of the device keeps running, so your monitoring dashboard may show a healthy encoder while the control systems that depend on ONVIF discovery cannot reach it. During a live event, that gap between "device is up" and "device is controllable" is where your production team loses time it does not have.

Because

CVE-2026-92450

uses a signing secret identical across every deployed device, an attacker who pulls the publicly available firmware can forge an administrative session token for any E3 they can reach, with no credentials and no login event to review afterwards.

The configuration write operations exposed by CVE-2026-110825 extend the damage past the encoder. An unauthenticated attacker can repoint DNS resolution and change the NTP time source. Redirected DNS lets them steer the device toward a server they control, and a manipulated clock undermines certificate validation, which is how traffic interception becomes practical against an appliance that otherwise looks correctly configured.

These devices are a persistence problem as much as a video problem. Production networks are frequently flat by design, because NDI discovery and low latency routing work better that way. An encoder with root shell access sits on the same broadcast VLAN as your switchers, playout servers, recording storage and control PCs, and it rarely appears in the places you would look for an intruder.

Ask yourself a few practical questions about your own estate:

• Is the E3 in your asset inventory, or does it live on a spreadsheet owned by the AV team rather than IT?
• Does your vulnerability scanner have credentials or even network reachability into the production VLAN?
• Who owns firmware updates for AV hardware, and when was the last one applied?
• Is anyone collecting logs from the encoder at all?

For most organizations the answers point the same direction. AV appliances get commissioned once by an integrator, validated against a show, and left alone for years because touching them risks breaking a working signal chain.

Contractual exposure follows. Broadcasters, venues and production houses sign service agreements with uptime and content integrity commitments, and a hijacked or interrupted feed puts you on the wrong side of those terms. Where your recordings capture identifiable individuals, such as patients, students, witnesses or employees in a townhall, unauthorized access to that material is a personal data incident with notification obligations attached, separate from the broadcast disruption itself.

Locating Exposed Kiloview Devices on Your Network

Start by building a list of every Kiloview encoder you own, including the units nobody tracks in the asset database. These boxes are often bought by production staff or facilities teams and racked without going through IT, so your CMDB is probably not the authoritative source. Walk the racks, check purchase records with your AV integrator, and ask the production team what sits between each camera and the stream.

Once you have the list, confirm the firmware level on each device through the web management interface. Anything below 1.30 is affected, and the vendor's fixed release is published on the Kiloview E3 firmware download page referenced in the CISA advisory. Record the version per serial number so you can prove coverage later rather than re-walking the racks.

For network discovery, three traffic signatures will find units you missed:

• mDNS/Bonjour announcements on UDP 5353, which NDI devices use to advertise themselves to receivers. Capture a few minutes of multicast traffic on each production VLAN and you will see every encoder announcing its name.
• ONVIF device service responses, the same service behind CVE-2026-111100 and CVE-2026-110825. Because it answers informational requests without authentication, an internal scan will return device identifiers and account lists from affected units, which is itself confirmation the device is unpatched.
• HTTP/HTTPS management interfaces on your AV subnets. Fingerprint the login page banner and correlate hits against your inventory list.

Then check exposure from the outside. Review your perimeter firewall rules and NAT table for any port forward pointing at an encoder, including forwards created temporarily for a remote event and never removed. Search your owned IP ranges in Shodan or Censys for ONVIF and NDI service fingerprints, and treat any hit as a device to pull offline before patching, since the ONVIF write operations and the forged-token path require no credentials at all.

On the compromise-hunting side, the hardcoded JWT signing secret behind CVE-2026-92450 means an attacker can present a valid administrative session without ever submitting a password. Your login logs may show nothing. Look instead at the effects of privileged actions:

• Stream destination or RTMP/SRT target changes that nobody on the production team requested.
• Device hostname, DNS resolver, or NTP server values that differ from your build standard, which is the signature of the unauthenticated ONVIF write path.
• Static route and network interface configuration entries that do not match your documented design.
• Outbound connections from encoder IP addresses to destinations outside your streaming provider and NTP sources. An encoder reaching the general internet on an unusual port deserves investigation.
• If you have shell access, inspect running processes, cron entries, and startup scripts, and verify that /etc/localtime still resolves inside the zoneinfo directory rather than somewhere unexpected.

Forward encoder syslog to your SIEM so these changes land somewhere a human reviews. In environments Capstone manages, Adlumin correlates administrative session activity across devices and identity sources, which surfaces privileged API use that arrives without a corresponding authentication event, the exact pattern a forged session token produces.

Document what you find per device: firmware version, exposure status, and whether configuration matches your baseline. That record becomes your patch worklist and your evidence that each unit was checked.

Remediation and Network Controls for Kiloview E3 Deployments

Your first move is to confirm no Kiloview E3 is reachable from the internet. Check the edge firewall for port forwards, NAT rules and any UPnP mappings pointing at encoder addresses, and remove them. The ONVIF device service and the web management API are the two listening services that carry the worst of these flaws, and neither has any business answering requests from outside your network.

Firmware V1.30 addresses all nine CVEs, so the update is a single action rather than a staged campaign. Schedule it around production windows, but do not let a broadcast calendar push it past a few weeks.

Patching alone does not close the credential problem. Because the pre-1.30 signing secret is identical across every shipped device and sessions were effectively non-expiring, treat any encoder that was internet-facing or sitting on a flat network as potentially accessed. After the update, do the following on each unit:

• Change the password on every account on the device, including the administrative account and any shared login your AV integrator uses.
• Review the configured user list and delete accounts nobody can account for.
• Inspect static routes, device hostname, DNS servers and the NTP source for values you did not set, since malicious configuration survives reboots.
• Disable the ONVIF service entirely if your workflow does not depend on it.

If a device's configuration looks altered and you have no clean baseline to compare against, factory reset it and rebuild the configuration by hand. That is faster than trying to prove a stream path is clean.

Over the next few weeks, move your encoders onto a dedicated production VLAN with access control lists that permit only the traffic the workflow needs. NDI discovery and stream traffic from your production subnets, control traffic from your switcher and automation systems, and nothing else. Deny encoder-initiated outbound connections except to the specific streaming destinations and the NTP server you have approved, which limits what a root-level implant can reach even if one is already present.

Administration should happen from one place. Restrict the web management interface to a jump host on your management VLAN and require VPN for any off-site access, so an administrative session cannot be opened from a production laptop on the guest wireless. SentinelOne covers that jump host in managed environments, which matters because the workstation holding encoder credentials is a far easier target than the encoder itself.

For the longer term, the gap this advisory exposes is ownership. Broadcast and AV appliances usually sit outside the patch cycle that covers servers and workstations, which is how firmware below 1.30 stays in a rack for years. Put every encoder, decoder, converter and streaming appliance into the same asset record your IT systems use, assign a named owner, and set a quarterly check against the vendor's firmware page and CISA ICS advisories.

Write disclosure expectations into procurement. Ask prospective vendors whether they publish machine-readable advisories, whether firmware images are signed, and who to contact when a researcher finds something. Build the same expectation into integrator contracts by specifying who applies firmware updates and within what window.

CISA reported no known public exploitation of these vulnerabilities at the time of publication, which gives you room to sequence this work properly instead of doing it during an incident.

Treating Broadcast Hardware as Part of the Attack Surface

Devices like the Kiloview E3 run a full Linux operating system with a web stack, a shell, and network services listening for requests, yet most organizations classify them as AV gear rather than as computers. That classification decides everything downstream: whether the unit appears in your vulnerability scans, whether anyone is accountable for its firmware, and whether a support contract exists to tell you when an advisory lands.

The ownership gap is usually structural. Your AV integrator installed the encoder, the production team operates it, and your IT group never received credentials or a maintenance window. Nobody is wrong, but nobody is watching the device either, and the vendor's advisories reach an inbox that does not route to security.

CISA places this equipment in the Communications and Information Technology sectors, deployed worldwide, with the vendor headquartered in China. The flaws were reported to CISA by researcher Juan Alonso, and as of the October 22, 2026 publication, no known public exploitation targeting them has been reported. That gives you a working window to deal with the issue as maintenance instead of as an incident.

Treat the encoder the way you treat any other Linux host sitting on a production network: it needs an owner, a firmware baseline, and a place in your inventory. If a box forwards traffic, resolves DNS, and accepts configuration writes, it belongs in the same program as your servers.

The action that matters most is the simple one. Identify every Kiloview E3 in your estate, confirm none of them answer from the internet, and apply the available firmware update to each.