{"id":"CVE-2026-110491","kind":"vulnerability","aliases":["CVE-2026-110491"],"related":[],"title":"E3 camera ONVIF service: malformed requests cause unauthenticated denial of service","description":"The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected service stops accepting new connections while the rest of the device continues operating normally, and will recover automatically after a period. This can be triggered repeatedly by any unauthenticated party with network access to the device.","summary":"Malformed or incomplete requests to certain ONVIF operations on the E3 device make its ONVIF service stop accepting new connections until it recovers on its own. Any unauthenticated party with network access to the device can trigger this repeatedly.","severity":"high","cvss":7.5,"epss":0.00386,"exploited":false,"exploited_at":null,"products":[{"name":"Kiloview E3 Firmware","fixed":["1.30"],"affected":"< 1.30","ecosystem":"vendor"}],"ecosystems":[],"tags":["denial-of-service","e3","infrastructure","iot","kiloview","ndi-encoder","network-cameras","onvif"],"not_affected_if":["firmware-1.30-or-later","no-network-access-to-device","onvif-disabled"],"how_to_check":"In the E3 web management UI check the firmware version; anything below 1.30 is affected. Then check whether the ONVIF service is reachable from untrusted networks (e.g. connect to the device's ONVIF port from outside the management network). Whether ONVIF is on by default is not stated by the vendor or CISA.","fix":"Update Kiloview E3 firmware to V1.30 (released 2026-10-10): https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/. No workaround published; until updated, restrict network access to the device's ONVIF port to trusted hosts.","status":"open","published_at":"2026-10-22T23:18:22+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:15:02+00:00","updated_at":"2026-10-25T03:16:20+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-25T03:15:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"E3 camera ONVIF service: malformed requests cause unauthenticated denial of service","impact":"low","summary":"Malformed or incomplete requests to certain ONVIF operations on the E3 device make its ONVIF service stop accepting new connections until it recovers on its own. Any unauthenticated party with network access to the device can trigger this repeatedly.","category":"infrastructure","nicknames":[],"who_cares":["e3","onvif","iot","network-cameras"],"confidence":0.6,"needs_auth":"no","worst_case":"ONVIF service stops accepting connections until it recovers automatically","analyst_note":"Find the vendor advisory and the affected and fixed E3 firmware versions, and check whether ONVIF is enabled by default; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-110491 may not list them.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-network-access-to-device","onvif-disabled"],"who_is_affected":"Owners of E3 devices with the ONVIF service reachable over the network are exposed; devices reachable only from a trusted local network carry less risk. The sources do not name affected firmware versions. The exposure is limited to losing the ONVIF service, not to data or code execution.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000585,"input_tokens":3363,"output_tokens":497,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory and the affected and fixed E3 firmware versions, and check whether ONVIF is enabled by default; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-110491 may not list them.","search":"'-110491':14A,17A '-2026':13A,16A 'accept':53B,98C 'access':67B,128C 'affect':95C 'automat':113C 'camera':2A,34B 'caus':7A 'certain':41B,92C 'connect':55B,100C 'continu':107C 'cve':12A,15A 'denial':9A,22B 'denial-of-servic':21B 'devic':47B,70B,106C,131C 'e3':1A,19A,25B,46B,80C 'encod':31B 'firmware':20A 'incomplet':38B,89C 'infrastructur':26B 'iot':27B 'kiloview':18A,28B 'make':48B 'malform':5A,36B,87C 'ndi':30B 'ndi-encod':29B 'network':33B,66B,127C 'network-camera':32B 'new':54B,99C 'normal':109C 'onvif':3A,35B,42B,50B,76C 'oper':43B,93C,108C 'parti':64B,125C 'period':116C 'recov':58B,112C 'render':83C 'repeat':74B,121C 'request':6A,39B,90C 'rest':103C 'send':86C 'servic':4A,11A,24B,51B,77C,96C 'stop':52B,97C 'trigger':72B,120C 'unauthent':8A,63B,124C 'unrespons':84C","nicknames":[],"mitigations":[],"who_affected":"Owners of E3 devices with the ONVIF service reachable over the network are exposed; devices reachable only from a trusted local network carry less risk. The sources do not name affected firmware versions. The exposure is limited to losing the ONVIF service, not to data or code execution.","tier":"B","verified":{"fix":{"at":"2026-10-25T03:16:20Z","by":"analyst","run_id":684}},"analyst_revisit_at":null,"first_public_at":"2026-10-22T23:18:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ics-cert@hq.dhs.gov","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110491","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110491","severity":null,"published_at":"2026-10-22T23:18:22+00:00","modified_at":"2026-10-23T19:57:42+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-110491","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110491","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-110491:684","url":null,"severity":null,"published_at":"2026-10-25T03:16:20+00:00","modified_at":"2026-10-25T03:16:20+00:00","first_seen_at":"2026-10-25T03:16:20+00:00","fetched_at":"2026-10-25T03:16:20+00:00","note":"CISA ICSA-26-295-01 (CNA ics-cert): Kiloview E3 firmware <1.30 affected, fixed in 1.30; vendor release notes confirm ONVIF malformed-request handling improved. ONVIF default-enabled state not stated in any source. No exploitation or PoC found; no community search done (tier B)."}],"documents":[{"id":1259,"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01","title":"CISA ICSA-26-295-01 Kiloview E3 NDI Encoder","kind":"advisory","source":"analyst","text":"Affected: E3 Firmware <1.30 (nine CVEs incl. CVE-2026-92450, hardcoded HMAC-SHA256 JWT secret, identical on all devices, recoverable from public firmware).","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1260,"url":"https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/","title":"Kiloview E3 firmware 1.30 release notes","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}