CVE-2026-110243

E3 Firmware: Kiloview E3 NDI Encoder OS Command Injection

Kiloview E3 Firmware

CVSS

9.9Critical

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)0.40%Chance of exploitation activity in the next 30 days, higher than 32% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in1.30Fixed versionCVE List

Published22 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

1.30E3 FirmwareCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Kiloview E3 NDI EncoderCISA ICS advisories, 22 Oct 2026

Description

The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform the same validation. An authenticated web user with permission to configure network settings can exploit this to execute arbitrary operating system commands as root.

Text from CVE List

Affected versions 2

E3 Firmwareaffected: all versions before 1.30CVE List
E3 Firmwareunaffected: 1.30CVE List