PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-1453 KiloView CVE debrief

CVE-2026-1453 is a critical missing-authentication vulnerability in KiloView Encoder Series hardware. According to the CISA advisory, an unauthenticated attacker could create or delete administrator accounts and thereby gain full administrative control of affected products. The advisory was first published on 2026-01-29 and updated on 2026-02-05 to note that the affected hardware versions are end-of-life, so KiloView does not plan to release patches for them.

Vendor
KiloView
Product
Encoder Series E1 hardware Version 1.4
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-01-29
Original CVE updated
2026-02-05
Advisory published
2026-01-29
Advisory updated
2026-02-05

Who should care

Administrators and operators of the affected KiloView Encoder Series hardware versions, especially teams responsible for device management, segmentation, and lifecycle planning for deployed encoder appliances.

Technical summary

The advisory describes a missing authentication for a critical function. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which aligns with a remotely exploitable issue requiring no privileges or user interaction and capable of full confidentiality, integrity, and availability impact. In practical terms, the flaw affects administrator account creation/deletion flows and can result in complete administrative takeover of the product. Update A states the affected hardware is end-of-life, so remediation is mitigation-only rather than patch-based.

Defensive priority

Immediate

Recommended defensive actions

  • Treat the affected KiloView Encoder Series devices as high priority for containment because no authentication is required and the impact is full administrative control.
  • Apply network isolation or strict segmentation to limit who can reach device management interfaces.
  • Plan replacement or upgrade to newer hardware generations, since the advisory states the affected versions are end-of-life and no patches will be released.
  • Review whether any affected devices are still in service across all listed product variants in the advisory before concluding exposure has been removed.
  • Contact KiloView support through the vendor contact channel referenced in the advisory for product-specific mitigation guidance.

Evidence notes

Primary evidence comes from the CISA CSAF advisory ICSA-26-029-01 and its Update A. The advisory text states that a missing authentication for a critical function can allow an unauthenticated attacker to create or delete administrator accounts and gain full administrative control. The revision history on 2026-02-05 adds that the affected products are end-of-life, and the remediation section says no patches will be released and recommends network isolation or upgrading to newer hardware generations. The supplied CVSS vector is 9.8/critical and network-reachable with no authentication or user interaction.

Official resources

CISA published the advisory for CVE-2026-1453 on 2026-01-29 and updated it on 2026-02-05 to note the affected hardware is end-of-life. This debrief uses those dates as the disclosure timeline.