---
id: "CVE-2026-110491"
kind: "vulnerability"
aliases: ["CVE-2026-110491"]
title: "E3 camera ONVIF service: malformed requests cause unauthenticated denial of service"
severity: "high"
cvss: 7.5
epss: 0.00386
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Kiloview E3 Firmware", "fixed": ["1.30"], "affected": "< 1.30", "ecosystem": "vendor"}]
ecosystems: []
tags: ["denial-of-service", "e3", "infrastructure", "iot", "kiloview", "ndi-encoder", "network-cameras", "onvif"]
not_affected_if: ["firmware-1.30-or-later", "no-network-access-to-device", "onvif-disabled"]
published_at: "2026-10-22T23:18:22+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T03:16:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110491", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-110491", "first_seen_at": "2026-10-24T07:15:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:16:20+00:00"}]
---

# E3 camera ONVIF service: malformed requests cause unauthenticated denial of service

Malformed or incomplete requests to certain ONVIF operations on the E3 device make its ONVIF service stop accepting new connections until it recovers on its own. Any unauthenticated party with network access to the device can trigger this repeatedly.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Kiloview E3 Firmware affected < 1.30 fixed 1.30

## How to check

In the E3 web management UI check the firmware version; anything below 1.30 is affected. Then check whether the ONVIF service is reachable from untrusted networks (e.g. connect to the device's ONVIF port from outside the management network). Whether ONVIF is on by default is not stated by the vendor or CISA.

## Fix

Update Kiloview E3 firmware to V1.30 (released 2026-10-10): https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/. No workaround published; until updated, restrict network access to the device's ONVIF port to trusted hosts.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110491
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-110491
- 2026-10-25T03:16:20+00:00 analyst — CISA ICSA-26-295-01 (CNA ics-cert): Kiloview E3 firmware <1.30 affected, fixed in 1.30; vendor release notes confirm ONVIF malformed-request handling improved. ONVIF default-enabled state not stated in any source. No exploitation or PoC found; no community search done (tier B).

## Documents

- [advisory] CISA ICSA-26-295-01 Kiloview E3 NDI Encoder https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01
- [fix] Kiloview E3 firmware 1.30 release notes https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/

## From the sources

The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected service stops accepting new connections while the rest of the device continues operating normally, and will recover automatically after a period. This can be triggered repeatedly by any unauthenticated party with network access to the device.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_