How do I check whether I am affected by CVE-2026-107861?

Check the device's software version and confirm it is 1.30 or later. Ways: the first LCD screen page shows version info; the web UI under System Settings after login; or GET /api/systemctrl/system/getSystemInfo (version:true) returns softwareVersion (needs a session). Then check exposure: the web management interface/API should not be reachable from untrusted networks or the internet. Note the on-device string format may differ from '1.30'; compare against the release page.

What is the fix for CVE-2026-107861?

Update E3 firmware to V1.30 or later (Kiloview E3 firmware download page; upload via System Settings > Firmware Upgrade, device reboots in about 1 minute). Until then, restrict web management/API access to trusted networks, since a sibling flaw in the same advisory (CVE-2026-92450, hardcoded JWT signing secret) lets attackers forge admin tokens.

Who is not affected by CVE-2026-107861?

Not affected if: firmware-1.30-or-later, web-admin-access-restricted.

Live › vulnerability › CVE-2026-107861

Go to dashboard

critical9.9Infrastructure

Kiloview E3 NDI encoder: hostname field lets logged-in users run root commands

The Kiloview E3 NDI encoder firmware passes its device hostname unquoted into a shell command. An authenticated web user can inject operating system commands that run as root, which gives full control of the device.

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

9.9

critical

scored by [email protected]

known so far6 of 6

First public: Oct 22, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.4% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker runs commands as root and takes full control of the device.
CVSS said: 9.9. The facts above say medium; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-107861

Go to dashboard

critical9.9Infrastructure

Kiloview E3 NDI encoder: hostname field lets logged-in users run root commands

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

9.9

critical

scored by [email protected]

known so far6 of 6

First public: Oct 22, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.4% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker runs commands as root and takes full control of the device.
CVSS said: 9.9. The facts above say medium; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Kiloview E3 NDI encoder: hostname field lets logged-in users run root commands

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

Kiloview E3 NDI encoder: hostname field lets logged-in users run root commands

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources