CVE-2026-110825
E3 Firmware: Kiloview E3 NDI Encoder Missing Authentication for Critical Function
Kiloview E3 Firmware
CVSS
7.5HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.34%Chance of exploitation activity in the next 30 days, higher than 26% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 1.30E3 FirmwareCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Reports 1
1 outlet mention it. Reports are not confirmation; each links to its source.
Description
The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this service. A remote, unauthenticated attacker can alter the device hostname, redirect DNS resolution, or modify the configured time source, enabling follow on attacks such as traffic interception or certificate validation bypass.
Text from CVE List
Affected versions 2
- E3 Firmwareaffected: all versions before 1.30CVE List
- E3 Firmwareunaffected: 1.30CVE List