---
id: "CVE-2026-110825"
kind: "vulnerability"
aliases: ["CVE-2026-110825"]
title: "Kiloview E3 NDI encoder: unauthenticated ONVIF calls change DNS and NTP"
severity: "high"
cvss: 8.7
epss: 0.00343
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Kiloview E3 firmware", "fixed": ["1.30"], "affected": "< 1.30", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["e3", "infrastructure", "iot-video", "kiloview", "ndi-encoder", "onvif"]
not_affected_if: ["firmware-1.30-or-later", "non-e3-models", "onvif-not-reachable", "onvif-service-disabled"]
published_at: "2026-10-22T23:18:22+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110825", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:38:44+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-110825", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Kiloview E3 NDI encoder: unauthenticated ONVIF calls change DNS and NTP

The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP write operations with no login, even when authentication is set for that service. A remote attacker can change the device hostname, redirect its DNS, or alter its time source, which enables traffic interception or certificate validation bypass.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Kiloview E3 firmware affected < 1.30 fixed 1.30

## How to check

Open the E3 web UI and read the firmware version (System/About); anything below 1.30 is affected. Also check whether the ONVIF device service port is reachable from untrusted networks.

## Fix

Update Kiloview E3 firmware to V1.30 (https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/). Until then, restrict network access to the ONVIF service to trusted hosts only.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110825
- 2026-10-23T23:38:44+00:00 analyst — CISA ICSA-26-295-01 (Oct 22) lists E3 firmware <1.30 affected, vendor fix V1.30; no exploitation or PoC found (VulDB: no exploit). Did not search social posts; no CVE-specific discussion likely. Kiloview download page not read directly.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-110825

## Documents

- [advisory] CISA ICSA-26-295-01 Kiloview E3 NDI Encoder https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01
- [mentions] Kiloview E3 Vulnerabilities Expose NDI Encoder to Root https://securityonline.info/kiloview-e3-vulnerabilities-ndi-encoder/

## From the sources

The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this service. A remote, unauthenticated attacker can alter the device hostname, redirect DNS resolution, or modify the configured time source, enabling follow on attacks such as traffic interception or certificate validation bypass.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_