{"id":"CVE-2026-109122","kind":"vulnerability","aliases":["CVE-2026-109122"],"related":[],"title":"Kiloview E3 NDI encoder: static route field lets an authenticated user run root commands","description":"The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system commands as root, and the malicious configuration persists across reboots. Successful exploitation could result in full device compromise, including exposure of stored credentials and cryptographic material.","summary":"The Kiloview E3 NDI encoder firmware does not sanitize one field when static routes are configured through its web management API. An authenticated web user who can configure static routes can run arbitrary OS commands as root, and the change survives reboots, exposing stored credentials and keys.","severity":"critical","cvss":9.4,"epss":0.00403,"exploited":false,"exploited_at":null,"products":[{"name":"Kiloview E3 firmware","fixed":["1.30"],"affected":"< 1.30","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["embedded-device","infrastructure","kiloview-e3","ndi-encoder"],"not_affected_if":["firmware-1.30-or-later","no-web-management-access-for-untrusted-users"],"how_to_check":"In the E3 web UI check the firmware version (System/About); anything below 1.30 is affected. Also check whether the web management interface is reachable from untrusted networks and which accounts can change static routes. The vendor does not publish an exact build string or the permission name; unknown.","fix":"Update Kiloview E3 firmware to 1.30 or later. Until then, restrict who holds static-route permissions in the web UI.","status":"open","published_at":"2026-10-22T22:17:59+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:41+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:31:41Z","model":"claude-haiku-5-5","output":{"fix":"Update Kiloview E3 firmware to 1.30 or later. Until then, restrict who holds static-route permissions in the web UI.","reach":"network","title":"Kiloview E3 NDI encoder: static route field lets an authenticated user run root commands","impact":"high","summary":"The Kiloview E3 NDI encoder firmware does not sanitize one field when static routes are configured through its web management API. An authenticated web user who can configure static routes can run arbitrary OS commands as root, and the change survives reboots, exposing stored credentials and keys.","category":"infrastructure","who_cares":["kiloview-e3","ndi-encoder","embedded-device"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker gets root on the device and reads stored credentials and keys.","analyst_note":"Confirm the exact firmware build string and the static-route permission name from the Kiloview advisory; the sources do not give a check command.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["firmware-1.30-or-later","no-web-management-access-for-untrusted-users"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000512,"input_tokens":3001,"output_tokens":423,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the exact firmware build string and the static-route permission name from the Kiloview advisory; the sources do not give a check command.","search":"'-109122':17A,20A '-2026':16A,19A 'across':133C 'affect':86C 'api':54B,106C 'arbitrari':66B,122C 'authent':10A,56B,108C 'chang':73B 'command':14A,68B,125C 'compromis':142C 'configur':49B,61B,99C,114C,131C 'could':137C 'credenti':78B,147C 'cryptograph':149C 'cve':15A,18A 'devic':26B,141C 'e3':2A,22A,30B,36B,88C 'embed':25B 'embedded-devic':24B 'encod':4A,33B,38B,90C 'execut':121C 'exploit':118C,136C 'expos':76B 'exposur':144C 'fail':92C 'field':7A,44B,96C 'firmwar':39B,91C 'firmware':23A 'full':140C 'includ':143C 'infrastructur':27B 'key':80B 'kiloview':1A,21A,29B,35B,87C 'kiloview-e3':28B 'let':8A 'malici':130C 'manag':53B,83C,105C 'materi':150C 'ndi':3A,32B,37B,89C 'ndi-encod':31B 'network':82C 'one':43B,95C 'oper':123C 'os':67B 'permiss':112C 'persist':132C 'reboot':75B,134C 'result':138C 'root':13A,70B,127C 'rout':6A,47B,63B,101C,116C 'run':12A,65B 'sanit':42B,94C 'servic':84C 'static':5A,46B,62B,100C,115C 'store':77B,146C 'success':135C 'surviv':74B 'system':124C 'use':97C 'user':11A,58B,110C 'via':102C 'web':52B,57B,104C,109C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T22:17:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ics-cert@hq.dhs.gov","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109122","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109122","severity":null,"published_at":"2026-10-22T22:17:59+00:00","modified_at":"2026-10-23T19:57:42+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109122:183","url":null,"severity":null,"published_at":"2026-10-23T22:13:24+00:00","modified_at":"2026-10-23T22:13:24+00:00","first_seen_at":"2026-10-23T22:13:24+00:00","fetched_at":"2026-10-23T22:13:24+00:00","note":"CISA ICSA-26-295-01 + NVD/OpenCVE: E3 firmware <1.30 affected, fixed in 1.30 (one of nine CVEs). No exploitation/PoC reported; social search not done."},{"source":"analyst","external_id":"CVE-2026-109122:286","url":null,"severity":null,"published_at":"2026-10-23T22:43:55+00:00","modified_at":"2026-10-23T22:43:55+00:00","first_seen_at":"2026-10-23T22:43:55+00:00","fetched_at":"2026-10-23T22:43:55+00:00","note":"Re-read Kiloview 1.30 release page (released 2026-10-10): version 1.30, mentions hardened network-management/API parameter validation; gives no build string or static-route permission name, so those stay unknown. Restored how_to_check, which the re-triage had blanked."},{"source":"epss","external_id":"CVE-2026-109122","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109122","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1259,"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01","title":"CISA ICSA-26-295-01 Kiloview E3 NDI Encoder","kind":"advisory","source":"analyst","text":"Affected: E3 Firmware <1.30 (nine CVEs incl. CVE-2026-92450, hardcoded HMAC-SHA256 JWT secret, identical on all devices, recoverable from public firmware).","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1260,"url":"https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/","title":"Kiloview E3 firmware 1.30 release notes","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1333,"url":"https://app.opencve.io/cve/CVE-2026-109122","title":"OpenCVE CVE-2026-109122","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}