---
id: "CVE-2026-109122"
kind: "vulnerability"
aliases: ["CVE-2026-109122"]
title: "Kiloview E3 NDI encoder: static route field lets an authenticated user run root commands"
severity: "critical"
cvss: 9.4
epss: 0.00403
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Kiloview E3 firmware", "fixed": ["1.30"], "affected": "< 1.30", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["embedded-device", "infrastructure", "kiloview-e3", "ndi-encoder"]
not_affected_if: ["firmware-1.30-or-later", "no-web-management-access-for-untrusted-users"]
published_at: "2026-10-22T22:17:59+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109122", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:13:24+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:43:55+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-109122", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Kiloview E3 NDI encoder: static route field lets an authenticated user run root commands

The Kiloview E3 NDI encoder firmware does not sanitize one field when static routes are configured through its web management API. An authenticated web user who can configure static routes can run arbitrary OS commands as root, and the change survives reboots, exposing stored credentials and keys.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Kiloview E3 firmware affected < 1.30 fixed 1.30

## How to check

In the E3 web UI check the firmware version (System/About); anything below 1.30 is affected. Also check whether the web management interface is reachable from untrusted networks and which accounts can change static routes. The vendor does not publish an exact build string or the permission name; unknown.

## Fix

Update Kiloview E3 firmware to 1.30 or later. Until then, restrict who holds static-route permissions in the web UI.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109122
- 2026-10-23T22:13:24+00:00 analyst — CISA ICSA-26-295-01 + NVD/OpenCVE: E3 firmware <1.30 affected, fixed in 1.30 (one of nine CVEs). No exploitation/PoC reported; social search not done.
- 2026-10-23T22:43:55+00:00 analyst — Re-read Kiloview 1.30 release page (released 2026-10-10): version 1.30, mentions hardened network-management/API parameter validation; gives no build string or static-route permission name, so those stay unknown. Restored how_to_check, which the re-triage had blanked.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-109122

## Documents

- [advisory] CISA ICSA-26-295-01 Kiloview E3 NDI Encoder https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01
- [describes] OpenCVE CVE-2026-109122 https://app.opencve.io/cve/CVE-2026-109122
- [fix] Kiloview E3 firmware 1.30 release notes https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/

## From the sources

The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system commands as root, and the malicious configuration persists across reboots. Successful exploitation could result in full device compromise, including exposure of stored credentials and cryptographic material.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_