CVE-2026-109122 Kiloview CVE debrief

Who should care

Defenders responsible for managing and securing Kiloview E3 NDI Encoder devices should assess exposure and apply the vendor-provided patch to prevent exploitation. This includes reviewing current device configurations, verifying system logs for signs of exploitation, and ensuring that only authorized users have access to the web management API. Additionally, defenders should prioritize monitoring for suspicious activity and update asset inventory to track

Why it matters

CVE-2026-109122 is a critical vulnerability in Kiloview E3 NDI Encoder firmware that allows authenticated users to execute arbitrary OS commands as root. Defenders should assess exposure, apply the vendor-provided patch, and monitor for suspicious activity to prevent potential device compromise and data exposure.

• Potential for full device compromise, including exposure of stored credentials and cryptographic material
• Possible persistence of malicious configurations across reboots
• Need for verification of affected versions and application of vendor-provided patch

Technical summary

The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system commands as root, and the malicious configuration persists across reboots. This vulnerability allows for potential full device compromise, including exposure of stored credentials and cryptographic material. The affected firmware versions are prior to 1.30.

Defensive priority

High

Recommended defensive actions

• Review and apply the vendor-provided patch (version 1.30) to address the vulnerability
• Restrict access to the web management API to authorized users only
• Monitor for suspicious activity on the affected devices
• Perform a thorough review of device configurations for potential malicious static routes
• Verify system logs for signs of exploitation attempts
• Update asset inventory to reflect affected devices
• Implement additional monitoring for network traffic on affected devices

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, CVSS score, and affected versions. The vendor has released a patch (version 1.30) to address the issue. Defenders should verify affected versions, review configuration for static routes, and apply the vendor-provided patch to prevent exploitation. Evidence is limited to CVE and source-item details; further verification is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.