{"id":"CVE-2026-107861","kind":"vulnerability","aliases":["CVE-2026-107861"],"related":[],"title":"Kiloview E3 NDI encoder: hostname field lets logged-in users run root commands","description":"The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary operating system commands as root, resulting in full device compromise.","summary":"The Kiloview E3 NDI encoder firmware passes its device hostname unquoted into a shell command. An authenticated web user can inject operating system commands that run as root, which gives full control of the device.","severity":"critical","cvss":9.9,"epss":0.00395,"exploited":false,"exploited_at":null,"products":[{"name":"Kiloview E3 firmware","fixed":["1.30"],"affected":"< 1.30","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["embedded-device","infrastructure","kiloview","ndi-encoder"],"not_affected_if":["firmware-1.30-or-later","web-admin-access-restricted"],"how_to_check":"Check the device's software version and confirm it is 1.30 or later. Ways: the first LCD screen page shows version info; the web UI under System Settings after login; or GET /api/systemctrl/system/getSystemInfo (version:true) returns softwareVersion (needs a session). Then check exposure: the web management interface/API should not be reachable from untrusted networks or the internet. Note the on-device string format may differ from '1.30'; compare against the release page.","fix":"Update E3 firmware to V1.30 or later (Kiloview E3 firmware download page; upload via System Settings > Firmware Upgrade, device reboots in about 1 minute). Until then, restrict web management/API access to trusted networks, since a sibling flaw in the same advisory (CVE-2026-92450, hardcoded JWT signing secret) lets attackers forge admin tokens.","status":"open","published_at":"2026-10-22T23:18:17+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:38+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:31:38Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Kiloview E3 firmware to 1.30 or later (affected versions are below 1.30).","reach":"network","title":"Kiloview E3 NDI encoder: hostname field lets logged-in users run root commands","impact":"high","summary":"The Kiloview E3 NDI encoder firmware passes its device hostname unquoted into a shell command. An authenticated web user can inject operating system commands that run as root, which gives full control of the device.","category":"infrastructure","who_cares":["kiloview","ndi-encoder","embedded-device"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker runs commands as root and takes full control of the device.","analyst_note":"Confirm the exact firmware check method and whether the device naming endpoint is reachable beyond the admin web UI; see NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-107861 and the vendor advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["firmware-1.30-or-later","web-admin-access-restricted"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000507,"input_tokens":2975,"output_tokens":419,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the exact firmware check method and whether the device naming endpoint is reachable beyond the admin web UI; see NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-107861 and the vendor advisory.","search":"'-107861':17A,20A '-2026':16A,19A 'accept':84C 'access':102C 'affect':72C 'arbitrari':111C 'authent':48B,98C 'charact':108C 'command':14A,46B,55B,96C,114C 'compromis':121C 'control':63B,69C 'cve':15A,18A 'devic':26B,40B,66B,87C,120C 'e3':2A,22A,34B,74C 'emb':107C 'embed':25B 'embedded-devic':24B 'encod':4A,31B,36B,76C 'endpoint':89C 'execut':110C 'fail':78C 'field':6A 'firmwar':37B,77C 'firmware':23A 'full':62B,119C 'function':105C 'give':61B 'hostnam':5A,41B,82C 'infrastructur':27B 'inject':52B 'kiloview':1A,21A,28B,33B,73C 'let':7A 'log':9A 'logged-in':8A 'name':88C 'ndi':3A,30B,35B,75C 'ndi-encod':29B 'oper':53B,112C 'paramet':83C 'pass':38B,90C 'result':117C 'root':13A,59B,116C 'run':12A,57B 'sanit':80C 'servic':70C 'shell':45B,95C 'system':54B,68C,113C 'unquot':42B,92C 'user':11A,50B,100C 'web':49B,99C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T23:18:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ics-cert@hq.dhs.gov","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107861","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107861","severity":null,"published_at":"2026-10-22T23:18:17+00:00","modified_at":"2026-10-23T19:57:42+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107861:152","url":null,"severity":null,"published_at":"2026-10-23T22:00:39+00:00","modified_at":"2026-10-23T22:00:39+00:00","first_seen_at":"2026-10-23T22:00:39+00:00","fetched_at":"2026-10-23T22:00:39+00:00","note":"CISA ICSA-26-295-01 + CVE record + Kiloview firmware page: E3 firmware <1.30 affected, fixed in 1.30 (all nine CVEs). No exploitation reported per CISA; VulDB says no exploit. Social search not done; the NVD page returned empty."},{"source":"analyst","external_id":"CVE-2026-107861:272","url":null,"severity":null,"published_at":"2026-10-23T22:39:30+00:00","modified_at":"2026-10-23T22:39:30+00:00","first_seen_at":"2026-10-23T22:39:30+00:00","fetched_at":"2026-10-23T22:39:30+00:00","note":"Return visit: how-to-check was empty, filled from Kiloview API manual and upgrade docs. Reachability: only the web management API is named by CISA; sibling CVE-2026-92450 (hardcoded JWT secret, same advisory) lets an attacker forge admin tokens, so the 'authenticated' precondition may not protect exposed devices. Unconfirmed: exact hostname endpoint path, and how 1.30 maps to the on-device version string (manuals show 1.00.00xx / 1.21.0008 formats)."},{"source":"epss","external_id":"CVE-2026-107861","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107861","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1259,"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01","title":"CISA ICSA-26-295-01 Kiloview E3 NDI Encoder","kind":"advisory","source":"analyst","text":"Affected: E3 Firmware <1.30 (nine CVEs incl. CVE-2026-92450, hardcoded HMAC-SHA256 JWT secret, identical on all devices, recoverable from public firmware).","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1262,"url":"https://www.kiloview.com/en/docs/re-3/firmware-download/","title":"Kiloview E3 firmware download, V1.30","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1265,"url":"https://www.cve.org/CVERecord?id=CVE-2026-107861","title":"CVE Record CVE-2026-107861","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1552,"url":"https://cnstatic.kiloview.com/wp-content/uploads/2026/02/E3-WEB-API%E8%AF%B4%E6%98%8E%E4%B9%A6-cnVersion-1.21.0008-1.pdf","title":"Kiloview E3 Web API manual (getSystemInfo returns softwareVersion)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1553,"url":"https://www.kiloview.com/en/docs/getting-3/firmware-upgrading/","title":"Kiloview E3 firmware upgrading","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}