{"id":"CVE-2026-110243","kind":"vulnerability","aliases":["CVE-2026-110243"],"related":[],"title":"Kiloview E3 NDI encoder: network setting lets logged-in user run root commands","description":"The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform the same validation. An authenticated web user with permission to configure network settings can exploit this to execute arbitrary operating system commands as root.","summary":"The network management service on Kiloview E3 NDI encoder firmware passes an unvalidated network interface name into a shell command. An authenticated web user who can change network settings can run arbitrary operating system commands as root.","severity":"critical","cvss":9.9,"epss":0.00395,"exploited":false,"exploited_at":null,"products":[{"name":"Kiloview E3 firmware","fixed":["1.30"],"affected":"< 1.30","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["command-injection","e3-ndi-encoder","embedded-device","infrastructure","kiloview","self-hosted"],"not_affected_if":["firmware-1.30-or-later","no-web-accounts-with-network-rights"],"how_to_check":"Check the firmware version on the device; versions below 1.30 are affected. unknown for any command-line check.","fix":"Upgrade Kiloview E3 firmware to 1.30 or later.\nLimit web accounts that can change network settings until patched.","status":"open","published_at":"2026-10-22T23:18:22+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:38+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:31:38Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Kiloview E3 firmware to 1.30 or later.\nLimit web accounts that can change network settings until patched.","reach":"network","title":"Kiloview E3 NDI encoder: network setting lets logged-in user run root commands","impact":"high","summary":"The network management service on Kiloview E3 NDI encoder firmware passes an unvalidated network interface name into a shell command. An authenticated web user who can change network settings can run arbitrary operating system commands as root.","category":"infrastructure","who_cares":["kiloview","e3-ndi-encoder","embedded-device","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker runs arbitrary commands as root on the encoder","analyst_note":"Confirm the affected version range from the vendor advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-110243 and check for a workaround if no fix is available.","how_to_check":"Check the firmware version on the device; versions below 1.30 are affected. unknown for any command-line check.","needs_analyst":true,"not_affected_if":["firmware-1.30-or-later","no-web-accounts-with-network-rights"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000525,"input_tokens":2987,"output_tokens":452,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor advisory or fixed firmware version for Kiloview E3 NDI and check how to verify the firmware build; NVD page only at https://nvd.nist.gov/vuln/detail/CVE-2026-110243.","search":"'-110243':17A,20A '-2026':16A,19A 'accept':94C 'address':99C 'affect':81C 'arbitrari':70B,132C 'authent':60B,118C 'chang':65B 'command':14A,25B,58B,73B,108C,135C 'command-inject':24B 'configur':100C,124C 'cve':15A,18A 'devic':33B 'e3':2A,22A,28B,45B,83C 'e3-ndi-encoder':27B 'embed':32B 'embedded-devic':31B 'encod':4A,30B,47B,85C 'endpoint':101C 'execut':131C 'exploit':128C 'fail':87C 'firmwar':48B,86C 'firmware':23A 'handler':111C 'host':38B 'infrastructur':34B 'inject':26B 'interfac':53B,92C 'kiloview':1A,21A,35B,44B,82C 'let':7A 'link':97C 'log':9A 'logged-in':8A 'mainten':98C 'manag':41B,78C 'name':54B,93C 'ndi':3A,29B,46B,84C 'network':5A,40B,52B,66B,77C,91C,125C 'oper':71B,133C 'pass':49B,103C 'perform':113C 'permiss':122C 'root':13A,75B,137C 'run':12A,69B 'self':37B 'self-host':36B 'servic':42B,79C 'set':6A,67B,126C 'shell':57B,107C 'sibl':110C 'system':72B,134C 'unlik':109C 'unvalid':51B 'user':11A,62B,120C 'valid':89C,116C 'web':61B,119C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T23:18:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ics-cert@hq.dhs.gov","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110243","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110243","severity":null,"published_at":"2026-10-22T23:18:22+00:00","modified_at":"2026-10-23T19:57:42+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-110243:151","url":null,"severity":null,"published_at":"2026-10-23T22:00:35+00:00","modified_at":"2026-10-23T22:00:35+00:00","first_seen_at":"2026-10-23T22:00:35+00:00","fetched_at":"2026-10-23T22:00:35+00:00","note":"CISA ICSA-26-295-01 (Oct 22) lists E3 firmware <1.30 affected; vendor release page confirms 1.30 (2026-10-10) hardens network management API. CISA: no known public exploitation. No PoC found. Did not search social; sibling CVEs in same advisory (e.g. CVE-2026-92450 hardcoded JWT secret) make this chainable to unauthenticated root."},{"source":"epss","external_id":"CVE-2026-110243","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110243","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1259,"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01","title":"CISA ICSA-26-295-01 Kiloview E3 NDI Encoder","kind":"advisory","source":"analyst","text":"Affected: E3 Firmware <1.30 (nine CVEs incl. CVE-2026-92450, hardcoded HMAC-SHA256 JWT secret, identical on all devices, recoverable from public firmware).","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1260,"url":"https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/","title":"Kiloview E3 firmware 1.30 release notes","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}