CVE-2026-107861

E3 Firmware: Kiloview E3 NDI Encoder OS Command Injection

Kiloview E3 Firmware

CVSS

9.9Critical

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)0.40%Chance of exploitation activity in the next 30 days, higher than 32% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in1.30Fixed versionCVE List

Published22 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

1.30E3 FirmwareCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Kiloview E3 NDI EncoderCISA ICS advisories, 22 Oct 2026

Description

The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary operating system commands as root, resulting in full device compromise.

Text from CVE List

Affected versions 2

E3 Firmwareaffected: all versions before 1.30CVE List
E3 Firmwareunaffected: 1.30CVE List