{"id":"CVE-2026-92450","kind":"vulnerability","aliases":["CVE-2026-92450"],"related":[],"title":"Kiloview E3 NDI encoder: hardcoded JWT key lets attackers forge admin sessions","description":"The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to the publicly distributed firmware can recover this secret and forge arbitrary session tokens, including administrative tokens, without valid credentials, enabling unauthenticated access to privileged device functions.","summary":"Kiloview E3 NDI encoder firmware signs session JSON Web Tokens with an HMAC-SHA256 secret hardcoded in the firmware image, identical on every device. An attacker who downloads the public firmware can recover the secret, forge administrative tokens, and reach privileged device functions without credentials.","severity":"high","cvss":8.7,"epss":0.00366,"exploited":false,"exploited_at":null,"products":[{"name":"Kiloview E3 Firmware","fixed":["1.30"],"affected":"< 1.30","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","kiloview","ndi","self-hosted","video-encoder"],"not_affected_if":["auth-not-jwt","other-firmware"],"how_to_check":"Open the E3 web UI and read the firmware version under system info; anything below 1.30 is vulnerable. Also check whether the management interface is reachable from untrusted networks.","fix":"Update E3 firmware to V1.30 (https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/). No workaround listed; restrict management interface to a trusted network until updated.","status":"open","published_at":"2026-10-22T23:20:33+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:35:07+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:35:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Kiloview E3 NDI encoder: hardcoded JWT key lets attackers forge admin sessions","impact":"high","summary":"Kiloview E3 NDI encoder firmware signs session JSON Web Tokens with an HMAC-SHA256 secret hardcoded in the firmware image, identical on every device. An attacker who downloads the public firmware can recover the secret, forge administrative tokens, and reach privileged device functions without credentials.","category":"infrastructure","who_cares":["kiloview","ndi","video-encoder","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker forges admin tokens and controls the encoder without credentials","analyst_note":"Confirm firmware version range and vendor fix at the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-92450) and Kiloview advisories; sources give no version or patch.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["other-firmware","auth-not-jwt"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000506,"input_tokens":2962,"output_tokens":419,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm firmware version range and vendor fix at the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-92450) and Kiloview advisories; sources give no version or patch.","search":"'-2026':14A,17A '-92450':15A,18A 'access':116C,139C 'across':109C 'admin':11A 'administr':68B,132C 'affect':82C 'arbitrari':128C 'attack':9A,57B,114C 'authent':78C 'credenti':76B,136C 'cve':13A,16A 'deploy':111C 'devic':55B,73B,112C,142C 'distribut':120C 'download':59B 'e3':2A,20A,32B,84C 'enabl':137C 'encod':4A,30B,34B,86C 'everi':54B 'firmwar':35B,50B,62B,87C,106C,121C 'firmware':21A 'forg':10A,67B,127C 'framework':79C 'function':74B,143C 'hardcod':5A,47B,99C 'hmac':44B,96C 'hmac-sha256':43B,95C 'host':27B 'ident':52B,108C 'imag':51B,107C 'includ':131C 'infrastructur':22B 'json':38B,90C 'jwt':6A 'key':7A 'kiloview':1A,19A,23B,31B,83C 'let':8A 'ndi':3A,24B,33B,85C 'privileg':72B,141C 'public':61B,119C 'reach':71B 'recov':64B,123C 'secret':46B,66B,98C,125C 'self':26B 'self-host':25B 'session':12A,37B,89C,129C 'sha256':45B,97C 'sign':36B,88C 'static':102C 'string':103C 'token':40B,69B,92C,130C,133C 'unauthent':138C 'use':80C,93C 'valid':135C 'video':29B 'video-encod':28B 'web':39B,91C 'within':104C 'without':75B,134C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T23:20:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ics-cert@hq.dhs.gov","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92450","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92450","severity":null,"published_at":"2026-10-22T23:20:33+00:00","modified_at":"2026-10-23T19:57:42+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-92450:484","url":null,"severity":null,"published_at":"2026-10-23T23:37:28+00:00","modified_at":"2026-10-23T23:37:28+00:00","first_seen_at":"2026-10-23T23:37:28+00:00","fetched_at":"2026-10-23T23:37:28+00:00","note":"CISA ICSA-26-295-01 + OpenCVE: E3 firmware <1.30 affected, fixed in V1.30; no known exploitation or public PoC per CISA. Kiloview's own advisory page not read; fix link taken from OpenCVE. Part of a nine-CVE batch (siblings 107861, 109122, 110243)."},{"source":"epss","external_id":"CVE-2026-92450","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92450","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1259,"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01","title":"CISA ICSA-26-295-01 Kiloview E3 NDI Encoder","kind":"advisory","source":"analyst","text":"Affected: E3 Firmware <1.30 (nine CVEs incl. CVE-2026-92450, hardcoded HMAC-SHA256 JWT secret, identical on all devices, recoverable from public firmware).","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2074,"url":"https://app.opencve.io/cve/CVE-2026-92450","title":"OpenCVE CVE-2026-92450","kind":"other","source":"analyst","text":"Affected < 1.30, unaffected 1.30. Vendor solution: update to V1.30 https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ . CVSS 4.0 8.7.","published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}