---
id: "CVE-2026-107861"
kind: "vulnerability"
aliases: ["CVE-2026-107861"]
title: "Kiloview E3 NDI encoder: hostname field lets logged-in users run root commands"
severity: "critical"
cvss: 9.9
epss: 0.00395
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Kiloview E3 firmware", "fixed": ["1.30"], "affected": "< 1.30", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["embedded-device", "infrastructure", "kiloview", "ndi-encoder"]
not_affected_if: ["firmware-1.30-or-later", "web-admin-access-restricted"]
published_at: "2026-10-22T23:18:17+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107861", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:00:39+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:39:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-107861", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Kiloview E3 NDI encoder: hostname field lets logged-in users run root commands

The Kiloview E3 NDI encoder firmware passes its device hostname unquoted into a shell command. An authenticated web user can inject operating system commands that run as root, which gives full control of the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Kiloview E3 firmware affected < 1.30 fixed 1.30

## How to check

Check the device's software version and confirm it is 1.30 or later. Ways: the first LCD screen page shows version info; the web UI under System Settings after login; or GET /api/systemctrl/system/getSystemInfo (version:true) returns softwareVersion (needs a session). Then check exposure: the web management interface/API should not be reachable from untrusted networks or the internet. Note the on-device string format may differ from '1.30'; compare against the release page.

## Fix

Update E3 firmware to V1.30 or later (Kiloview E3 firmware download page; upload via System Settings > Firmware Upgrade, device reboots in about 1 minute). Until then, restrict web management/API access to trusted networks, since a sibling flaw in the same advisory (CVE-2026-92450, hardcoded JWT signing secret) lets attackers forge admin tokens.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107861
- 2026-10-23T22:00:39+00:00 analyst — CISA ICSA-26-295-01 + CVE record + Kiloview firmware page: E3 firmware <1.30 affected, fixed in 1.30 (all nine CVEs). No exploitation reported per CISA; VulDB says no exploit. Social search not done; the NVD page returned empty.
- 2026-10-23T22:39:30+00:00 analyst — Return visit: how-to-check was empty, filled from Kiloview API manual and upgrade docs. Reachability: only the web management API is named by CISA; sibling CVE-2026-92450 (hardcoded JWT secret, same advisory) lets an attacker forge admin tokens, so the 'authenticated' precondition may not protect exposed devices. Unconfirmed: exact hostname endpoint path, and how 1.30 maps to the on-device version string (manuals show 1.00.00xx / 1.21.0008 formats).
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-107861

## Documents

- [advisory] CISA ICSA-26-295-01 Kiloview E3 NDI Encoder https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01
- [describes] CVE Record CVE-2026-107861 https://www.cve.org/CVERecord?id=CVE-2026-107861
- [fix] Kiloview E3 firmware download, V1.30 https://www.kiloview.com/en/docs/re-3/firmware-download/
- [fix] Kiloview E3 firmware upgrading https://www.kiloview.com/en/docs/getting-3/firmware-upgrading/
- [mentions] Kiloview E3 Web API manual (getSystemInfo returns softwareVersion) https://cnstatic.kiloview.com/wp-content/uploads/2026/02/E3-WEB-API%E8%AF%B4%E6%98%8E%E4%B9%A6-cnVersion-1.21.0008-1.pdf

## From the sources

The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary operating system commands as root, resulting in full device compromise.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_