---
id: "CVE-2026-110243"
kind: "vulnerability"
aliases: ["CVE-2026-110243"]
title: "Kiloview E3 NDI encoder: network setting lets logged-in user run root commands"
severity: "critical"
cvss: 9.9
epss: 0.00395
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Kiloview E3 firmware", "fixed": ["1.30"], "affected": "< 1.30", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["command-injection", "e3-ndi-encoder", "embedded-device", "infrastructure", "kiloview", "self-hosted"]
not_affected_if: ["firmware-1.30-or-later", "no-web-accounts-with-network-rights"]
published_at: "2026-10-22T23:18:22+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110243", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:00:35+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-110243", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Kiloview E3 NDI encoder: network setting lets logged-in user run root commands

The network management service on Kiloview E3 NDI encoder firmware passes an unvalidated network interface name into a shell command. An authenticated web user who can change network settings can run arbitrary operating system commands as root.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Kiloview E3 firmware affected < 1.30 fixed 1.30

## How to check

Check the firmware version on the device; versions below 1.30 are affected. unknown for any command-line check.

## Fix

Upgrade Kiloview E3 firmware to 1.30 or later.
Limit web accounts that can change network settings until patched.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110243
- 2026-10-23T22:00:35+00:00 analyst — CISA ICSA-26-295-01 (Oct 22) lists E3 firmware <1.30 affected; vendor release page confirms 1.30 (2026-10-10) hardens network management API. CISA: no known public exploitation. No PoC found. Did not search social; sibling CVEs in same advisory (e.g. CVE-2026-92450 hardcoded JWT secret) make this chainable to unauthenticated root.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-110243

## Documents

- [advisory] CISA ICSA-26-295-01 Kiloview E3 NDI Encoder https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01
- [fix] Kiloview E3 firmware 1.30 release notes https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/

## From the sources

The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform the same validation. An authenticated web user with permission to configure network settings can exploit this to execute arbitrary operating system commands as root.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_