CVE-2026-111100

E3 Firmware: Kiloview E3 NDI Encoder Missing Authentication for Critical Function

Kiloview E3 Firmware

CVSS

5.3Medium

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)0.30%Chance of exploitation activity in the next 30 days, higher than 21% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in1.30Fixed versionCVE List

Published22 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

1.30E3 FirmwareCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Kiloview E3 NDI EncoderCISA ICS advisories, 22 Oct 2026

Description

The ONVIF device service on the E3 responds to certain informational requests without requiring authentication. A remote, unauthenticated party can retrieve detailed device identifiers along with a list of configured user accounts and their privilege levels. This aids attackers in fingerprinting vulnerable devices and preparing targeted credential attacks.

Text from CVE List

Affected versions 2

E3 Firmwareaffected: all versions before 1.30CVE List
E3 Firmwareunaffected: 1.30CVE List