CVE-2026-105265 Kiloview CVE debrief

Who should care

Defenders responsible for Kiloview E3 NDI Encoder devices and systems should assess exposure and prioritize verification and updates to prevent potential path traversal attacks. This includes system administrators, security teams, and IT personnel responsible for maintaining and securing the affected systems. Additionally, operators and users of the affected systems should be aware of the potential vulnerability and take necessary precautions to prevent or

Why it matters

CVE-2026-105265 is a medium-severity vulnerability in Kiloview E3 NDI Encoder's time zone parameter. Defenders should prioritize verification, updates, and monitoring to prevent potential path traversal attacks.

• Verify and update affected E3 Firmware versions to prevent potential exploitation
• Restrict access to time zone parameter configurations to reduce attack surface
• Monitor for suspicious activity related to /etc/localtime modifications

Technical summary

The vulnerability exists in the time zone parameter of Kiloview E3 NDI Encoder, allowing an authenticated user to potentially cause /etc/localtime to point to a file outside the intended zoneinfo directory. The CVSS score is 5.3, indicating medium severity. The vulnerability could allow an attacker to manipulate the system's time zone settings, potentially leading to security issues. The vulnerability is limited to authenticated users and does not allow for remote code execution or privilege escalation. However, defenders should prioritize verifying and updating affected E3 Firmware versions to prevent potential path traversal attacks.

Defensive priority

Defenders should prioritize verifying and updating affected E3 Firmware versions to prevent potential path traversal attacks.

Recommended defensive actions

• Verify E3 Firmware version and update to 1.30 or later if necessary
• Review and restrict access to time zone parameter configurations
• Monitor for suspicious activity related to /etc/localtime modifications
• Perform a thorough review of system logs for signs of potential exploitation
• Implement additional monitoring for system time zone changes
• Review system configurations for potential vulnerabilities
• Update documentation with guidance on verifying system time zone settings

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional information on exploitation or impact is limited. There is no evidence of public exploitation or widespread impact. The CVE record was published on 2026-10-22T21:58:34.789Z and has not been modified since then. The source item provides a brief description of the vulnerability. No additional information is available on the vulnerability's attack surface or potential mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.