{"id":"CVE-2026-110825","kind":"vulnerability","aliases":["CVE-2026-110825"],"related":[],"title":"Kiloview E3 NDI encoder: unauthenticated ONVIF calls change DNS and NTP","description":"The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this service. A remote, unauthenticated attacker can alter the device hostname, redirect DNS resolution, or modify the configured time source, enabling follow on attacks such as traffic interception or certificate validation bypass.","summary":"The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP write operations with no login, even when authentication is set for that service. A remote attacker can change the device hostname, redirect its DNS, or alter its time source, which enables traffic interception or certificate validation bypass.","severity":"high","cvss":8.7,"epss":0.00343,"exploited":false,"exploited_at":null,"products":[{"name":"Kiloview E3 firmware","fixed":["1.30"],"affected":"< 1.30","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["e3","infrastructure","iot-video","kiloview","ndi-encoder","onvif"],"not_affected_if":["firmware-1.30-or-later","non-e3-models","onvif-not-reachable","onvif-service-disabled"],"how_to_check":"Open the E3 web UI and read the firmware version (System/About); anything below 1.30 is affected. Also check whether the ONVIF device service port is reachable from untrusted networks.","fix":"Update Kiloview E3 firmware to V1.30 (https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/). Until then, restrict network access to the ONVIF service to trusted hosts only.","status":"open","published_at":"2026-10-22T23:18:22+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:35:07+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:35:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Kiloview E3 NDI encoder: unauthenticated ONVIF calls change DNS and NTP","impact":"medium","summary":"The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP write operations with no login, even when authentication is set for that service. A remote attacker can change the device hostname, redirect its DNS, or alter its time source, which enables traffic interception or certificate validation bypass.","category":"infrastructure","who_cares":["kiloview","ndi-encoder","onvif","iot-video"],"confidence":0.7,"needs_auth":"no","worst_case":"attacker redirects DNS and time, enabling interception of device traffic","analyst_note":"Find the affected firmware versions and the fixed build in the vendor advisory; NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-110825 does not list them.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["non-e3-models","onvif-service-disabled"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000505,"input_tokens":2962,"output_tokens":417,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected firmware versions and the fixed build in the vendor advisory; NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-110825 does not list them.","search":"'-110825':14A,17A '-2026':13A,16A 'accept':42B,95C 'affect':36B,89C 'alter':72B,122C 'attack':62B,120C,138C 'authent':54B,105C,112C 'bypass':83B,146C 'call':7A 'certif':81B,144C 'chang':8A,64B 'configur':100C,111C,132C 'cve':12A,15A 'devic':33B,66B,86C,109C,124C 'dns':9A,44B,70B,97C,127C 'e3':2A,19A,21B,38B,91C 'enabl':77B,135C 'encod':4A,29B,40B,93C 'even':52B 'firmwar':41B,94C 'firmware':20A 'follow':136C 'hostnam':43B,67B,96C,125C 'infrastructur':22B 'intercept':79B,142C 'iot':24B 'iot-video':23B 'kiloview':1A,18A,26B,37B,90C 'login':51B 'modifi':130C 'ndi':3A,28B,39B,92C 'ndi-encod':27B 'ntp':11A,46B,99C 'onvif':6A,30B,32B,85C 'oper':48B,102C 'redirect':68B,126C 'regardless':106C 'remot':61B,118C 'requir':104C 'resolut':128C 'servic':34B,59B,87C,116C 'set':56B,113C 'sourc':75B,134C 'time':74B,133C 'traffic':78B,141C 'unauthent':5A,119C 'valid':82B,145C 'video':25B 'without':103C 'write':47B,101C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T23:18:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ics-cert@hq.dhs.gov","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110825","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110825","severity":null,"published_at":"2026-10-22T23:18:22+00:00","modified_at":"2026-10-23T19:57:42+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-110825:485","url":null,"severity":null,"published_at":"2026-10-23T23:38:44+00:00","modified_at":"2026-10-23T23:38:44+00:00","first_seen_at":"2026-10-23T23:38:44+00:00","fetched_at":"2026-10-23T23:38:44+00:00","note":"CISA ICSA-26-295-01 (Oct 22) lists E3 firmware <1.30 affected, vendor fix V1.30; no exploitation or PoC found (VulDB: no exploit). Did not search social posts; no CVE-specific discussion likely. Kiloview download page not read directly."},{"source":"epss","external_id":"CVE-2026-110825","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110825","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[{"id":1259,"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01","title":"CISA ICSA-26-295-01 Kiloview E3 NDI Encoder","kind":"advisory","source":"analyst","text":"Affected: E3 Firmware <1.30 (nine CVEs incl. CVE-2026-92450, hardcoded HMAC-SHA256 JWT secret, identical on all devices, recoverable from public firmware).","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2091,"url":"https://securityonline.info/kiloview-e3-vulnerabilities-ndi-encoder/","title":"Kiloview E3 Vulnerabilities Expose NDI Encoder to Root","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}