Live › vulnerability › CVE-2026-110825
Go to dashboardThe ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP write operations with no login, even when authentication is set for that service. A remote attacker can change the device hostname, redirect its DNS, or alter its time source, which enables traffic interception or certificate validation bypass.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Kiloview E3 firmware | vendor | < 1.30 | 1.30 |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this service. A remote, unauthenticated attacker can alter the device hostname, redirect DNS resolution, or modify the configured time source, enabling follow on attacks such as traffic interception or certificate validation bypass.
This page as .md · .json · in your agent: get_signal("CVE-2026-110825")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.