{"id":"CVE-2026-96616","kind":"vulnerability","aliases":["CVE-2026-96616"],"related":[],"title":"E3 web management: login tokens expire far too late, stay valid","description":"Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them non-expiring. A token obtained through interception or device compromise remains valid for authenticated access for an extended period.","summary":"Kiloview E3 NDI Encoder firmware before 1.30 issues web management login tokens with an expiry far beyond a reasonable session length (CWE-613), so a captured token stays usable for a long time.","severity":"high","cvss":8.3,"epss":0.003,"exploited":false,"exploited_at":null,"products":[{"name":"Kiloview E3 Firmware","fixed":["1.30"],"affected":"< 1.30","ecosystem":"vendor"}],"ecosystems":[],"tags":["e3","firmware","ics","infrastructure","kiloview","ndi-encoder","session-expiration","web-management"],"not_affected_if":["firmware-1.30-or-later","web-ui-not-reachable"],"how_to_check":"Open the E3 web management UI (System/About page) and read the firmware version; anything below 1.30 is affected.","fix":"Update E3 firmware to V1.30 or later (download: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/). Until then, keep the web UI off untrusted networks and use HTTPS if available.","status":"open","published_at":"2026-10-22T22:20:01+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:02:03+00:00","updated_at":"2026-10-25T03:17:21+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-25T03:02:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"E3 web management: login tokens expire far too late, stay valid","impact":"high","summary":"The web management interface of the E3 device issues login tokens with an expiration time far beyond any reasonable session length, so they effectively never expire. A token captured through interception or from a compromised device stays usable for authenticated access for a long time.","category":"infrastructure","nicknames":[],"who_cares":["e3","web-management"],"confidence":0.5,"needs_auth":"yes","worst_case":"Stolen login token grants long-lived authenticated management access","analyst_note":"Identify the E3 product and vendor, the affected firmware versions and the fixed release from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-96616.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000509,"input_tokens":3333,"output_tokens":351,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the E3 product and vendor, the affected firmware versions and the fixed release from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-96616.","search":"'-2026':13A,16A '-613':57B '-96616':14A,17A '1.30':41B 'access':109C 'authent':68C,108C 'beyond':51B,86C 'captur':60B 'compromis':104C 'cve':12A,15A 'cwe':56B 'devic':103C 'e3':1A,19A,21B,36B,73C 'effect':91C 'encod':28B,38B 'expir':6A,31B,83C,96C 'expiri':49B 'extend':112C 'far':7A,50B,85C 'firmwar':22B,39B 'firmware':20A 'given':81C 'ic':23B 'infrastructur':24B 'intercept':101C 'interfac':77C 'issu':42B,70C 'kiloview':18A,25B,35B 'late':9A 'length':55B 'lifetim':90C 'login':4A,45B,79C 'long':66B 'make':92C 'manag':3A,34B,44B,76C 'ndi':27B,37B 'ndi-encod':26B 'non':95C 'non-expir':94C 'obtain':99C 'period':113C 'reason':53B,88C 'remain':105C 'session':30B,54B,89C 'session-expir':29B 'stay':10A,62B 'time':67B,84C 'token':5A,46B,61B,69C,98C 'usabl':63B 'valid':11A,106C 'web':2A,33B,43B,75C 'web-manag':32B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T22:20:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ics-cert@hq.dhs.gov","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96616","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96616","severity":null,"published_at":"2026-10-22T22:20:01+00:00","modified_at":"2026-10-23T19:57:42+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-96616","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96616","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96616:685","url":null,"severity":null,"published_at":"2026-10-25T03:17:21+00:00","modified_at":"2026-10-25T03:17:21+00:00","first_seen_at":"2026-10-25T03:17:21+00:00","fetched_at":"2026-10-25T03:17:21+00:00","note":"Kiloview E3 NDI Encoder firmware <1.30, fixed in 1.30; read CISA ICSA-26-295-01 and NVD JSON (relays vendor advice; vendor page not read, so nothing marked verified). No PoC or exploitation known (SSVC exploitation none). Part of a 9-CVE batch in the same advisory."}],"documents":[{"id":1259,"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01","title":"CISA ICSA-26-295-01 Kiloview E3 NDI Encoder","kind":"advisory","source":"analyst","text":"Affected: E3 Firmware <1.30 (nine CVEs incl. CVE-2026-92450, hardcoded HMAC-SHA256 JWT secret, identical on all devices, recoverable from public firmware).","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3104,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96616","title":"NVD CVE-2026-96616","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}