PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-110243 Kiloview CVE debrief

The Kiloview E3 NDI encoder has a critical vulnerability allowing authenticated users to execute arbitrary OS commands as root due to improper validation of network interface names. This issue affects firmware versions prior to 1.30. The vulnerability is caused by the network management service failing to validate network interface names before passing them to shell commands, allowing an authenticated web user with network settings permission to exploit this and execute arbitrary OS commands as root. Defenders and administrators should assess exposure and prioritize remediation due to the critical severity and potential for arbitrary command execution.

Vendor
Kiloview
Product
E3 Firmware
CVSS
CRITICAL 9.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-22
Original CVE updated
2026-10-23
Advisory published
2026-10-22
Advisory updated
2026-10-23

Who should care

Defenders and administrators of Kiloview E3 NDI encoders should assess exposure and prioritize remediation due to the critical severity and potential for arbitrary command execution.

Why it matters

CVE-2026-110243 is a critical vulnerability in Kiloview E3 NDI encoders allowing authenticated users to execute arbitrary OS commands. Defenders should assess exposure, prioritize remediation, and verify firmware versions.

  • Potential for arbitrary OS command execution as root
  • Exposure of sensitive network settings
  • Possible disruption of critical infrastructure operations
  • Need for verification of firmware versions and remediation

Technical summary

The network management service on affected Kiloview E3 NDI encoder firmware fails to validate network interface names before passing them to shell commands. An authenticated web user with network settings permission can exploit this to execute arbitrary OS commands as root. The vulnerability affects firmware versions prior to 1.30 and allows for arbitrary OS command execution. Defenders should assess exposure and prioritize remediation due to the critical severity of this vulnerability. The vulnerability is caused by improper validation of network interface names, allowing an attacker to execute arbitrary OS commands.

Defensive priority

High priority for immediate assessment and remediation

Recommended defensive actions

  • Assess exposure by identifying Kiloview E3 NDI encoders in the environment
  • Verify firmware versions and upgrade to 1.30 or later if vulnerable
  • Implement compensating controls such as restricting access to network settings
  • Review and update incident response plans to address potential exploitation
  • Conduct a thorough risk assessment to identify potential impacts on the organization
  • Develop a remediation plan to address vulnerable systems
  • Monitor system logs for potential exploitation attempts

Evidence notes

The CVE Program and NVD records confirm the vulnerability in Kiloview E3 NDI encoder firmware versions prior to 1.30. Limited details on exploitation or impact are provided. The vulnerability allows authenticated users to execute arbitrary OS commands as root. The issue is caused by improper validation of network interface names. Defenders should verify firmware versions and assess exposure.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-110243 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-110243

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-110243 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110243

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Kiloview E3 NDI Encoder OS Command Injection

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110243.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-01.json

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.