Someone left the stage door unlocked at a theater that only seats fifty people
CVE-2026-110243 is an OS command injection (CWE-78) in the network management service of the Kiloview E3 NDI encoder, a specialized 4K HDMI/SDI AV-over-IP video encoder used in broadcast, live events, education, and enterprise video production. The vulnerable endpoint — the *link maintenance address configuration* handler — accepts a network interface name parameter and passes it unsanitized into a shell command, unlike sibling handlers in the same service that properly validate the same input. An authenticated web user with network configuration permissions can inject arbitrary commands that execute as root on the underlying Linux OS. All firmware versions prior to V1.30 are affected. This is one of nine CVEs disclosed simultaneously via CISA advisory ICSA-26-295-01, including two other root command injections (CVE-2026-107861, CVE-2026-109122) and — critically — CVE-2026-92450, a hard-coded JWT HMAC-SHA256 signing secret identical across all deployed devices. Because Kiloview firmware is publicly downloadable, any attacker can extract the JWT secret and forge administrative tokens, effectively reducing the PR:L authentication requirement to PR:N. The practical chain is therefore unauthenticated root RCE.
The vendor (via CISA/ICS-CERT as CNA) rates this CRITICAL at CVSS 9.9, and the vector math is technically correct — S:C reflects that root on the device can pivot beyond the encoder itself. However, the 9.9 overstates real-world risk for most security teams. The Kiloview E3 is a niche AV-over-IP appliance, not a mass-market network edge device or identity provider. The global installed base is likely in the low thousands. CISA's own guidance says to keep these devices off the internet and behind firewalls, which most professional broadcast deployments already do. The bug is genuinely dangerous *if you have these devices* — the chain from firmware download → JWT forge → root shell is trivial and requires zero prior access beyond network reachability — but the population of exposed targets is extremely small. noisgate rates this HIGH (8.1), not CRITICAL: the exploit chain is real but the blast radius is bounded by the device's role and deployment footprint.
5 steps from start to impact.
Acquire firmware image and extract JWT secret
- Internet access to download publicly available firmware
- None — firmware is freely downloadable without authentication
Forge administrative JWT session token
pyjwt, jwt_tool, jwt.io). The token is accepted by any unpatched E3 device as a legitimate admin session. This completely bypasses the authentication layer described in the CVSS vector's PR:L.- Extracted JWT signing secret from Step 1
- None — this is a deterministic cryptographic operation
Reach the E3 web management interface
- Network reachability to the E3 management interface (TCP/80 or TCP/443)
- CISA guidance recommends network isolation behind firewalls
- Professional broadcast deployments typically segment AV infrastructure
- Most E3 units should not be internet-facing
Inject OS command via network interface name parameter
- Valid admin session (forged JWT from Step 2)
- Network access to web management (Step 3)
- None once Steps 1-3 are complete — the injection is straightforward CWE-78
Post-exploitation: pivot or persist
- Root shell on the E3 device (Step 4)
- Device is an encoder with limited tooling — no package manager, constrained storage
- Lateral movement depends on flat network architecture
- Purpose-built Linux with limited attack surface for hosting further tools
;, |, $(), backticks) in the interface name field. This provides detection but not prevention. Useful as an interim measure while patching is scheduled.- WAF in front of the E3 — these are embedded devices with custom APIs, not standard web applications. Generic WAF rules are unlikely to parse the proprietary API parameters correctly, and the device's HTTPS certificate handling may break WAF TLS inspection.
- Changing the default JWT secret — the secret is hard-coded in the firmware binary; there is no configuration option to change it on unpatched firmware. Only the V1.30 firmware update addresses this.
- Disabling the web management interface — the E3's web UI is the primary management interface for the device. Disabling it (if even possible) would render the encoder unmanageable and break operational workflows.
The supporting signals.
| In-the-Wild Exploitation | None known. Not listed on CISA KEV. CISA advisory ICSA-26-295-01 states no known public exploitation. Disclosed 2026-10-22 — less than 48 hours old at time of assessment. |
|---|---|
| Proof-of-Concept | No public PoC found. No repos on GitHub named after CVE-2026-110243. Not indexed on pocindex.io. No ExploitDB, Nuclei template, or Metasploit module identified. However, the vulnerability is trivial CWE-78 command injection — a weaponized exploit would require minimal effort for any competent researcher. |
| EPSS Score | Not yet scored — CVE was published 2026-10-22; EPSS model typically ingests new CVEs within 1-2 weeks. Expect moderate EPSS given the ICS/embedded device category and lack of mass exploitation history. |
| CISA KEV Status | Not listed. No known exploitation to trigger KEV addition. Monitor for changes given the trivial exploit chain. |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (9.9). Also scored under v4.0 as 9.4. The S:C (Scope Changed) reflects that root compromise of the device enables impact beyond the encoder itself (network pivot). The PR:L is technically accurate for this CVE in isolation but effectively PR:N when chained with CVE-2026-92450 (hard-coded JWT secret). |
| Affected Versions | All Kiloview E3 firmware < 1.30. Historical firmware versions from 1.01.0006 through 1.24.0011.0013 (released 2026-01-05) are confirmed vulnerable. |
| Fixed Version | V1.30 — released 2026-10-10 (12 days before the CISA advisory). Available at kiloview.com/en/download-category/e3-ware/. |
| Chain Amplifier | CVE-2026-92450 (CVSS 7.5) — hard-coded HMAC-SHA256 JWT signing secret in firmware, identical across all devices. Firmware is publicly downloadable. This converts the authenticated command injection into an effectively unauthenticated root RCE chain. |
| Scanning / Exposure | No specific Shodan/Censys/GreyNoise data found for Kiloview E3 exposure. The E3 runs a web management interface on port 80/443 with identifiable fingerprints. Kiloview claims deployment in 140+ countries but the E3 is a niche professional AV product — installed base likely in the low thousands globally. |
| Researcher / Disclosure | All nine vulnerabilities reported by Juan Alonso to CISA. Coordinated disclosure via CISA ICS-CERT advisory ICSA-26-295-01, published 2026-10-22. |
Sources.
Why this verdict
- Auth bypass nullifies PR:L: CVE-2026-92450 provides a trivial authentication bypass — the JWT signing secret is hard-coded, identical across all devices, and recoverable from publicly downloadable firmware. The effective privilege requirement for the full chain is
PR:N, notPR:L. This would normally push severity *up*, but it's already at 9.9 — the chain ease is already captured in the baseline. - Niche installed base limits blast radius: The Kiloview E3 is a specialized 4K NDI video encoder, not a mass-market appliance. Global deployed units are likely in the low thousands. The overwhelming majority of enterprise security teams have zero E3 devices in their fleet. This compresses the real-world severity dramatically compared to a vulnerability in, say, a Fortinet firewall or Cisco switch with millions of deployments.
- Role multiplier: low-value to typical roles dominate. (a) *Low-value:* demo units, AV labs, trade show setups — no meaningful blast radius. (b) *Typical:* production video encoder in a broadcast control room or live event truck — blast radius is host-level (one encoder) with potential to disrupt a single video feed. (c) *High-value:* an E3 on a flat broadcast network where root access enables lateral movement to other production systems or manipulation of live feeds. Even in the high-value case, the blast radius is *host → segment* at most, not domain/fleet/supply-chain. The E3 is not a canonically high-value-role component — it does not appear in the identity, PKI, hypervisor, CI/CD, backup, database, kernel-agent, network-edge, SIEM, or OT/ICS controller categories. No severity floor is triggered.
- Network segmentation is standard practice for AV infrastructure: CISA explicitly recommends isolating these devices behind firewalls, and professional broadcast deployments typically place encoders on dedicated production VLANs. The attacker needs network reachability to the management port — this is a real friction point that filters out most opportunistic attacks.
- No exploitation activity and zero public PoC: Despite the trivial nature of the bug, there is no evidence of exploitation, no PoC code, no scanner coverage, and no threat actor interest in Kiloview encoders as of 2026-10-23. The advisory is less than 48 hours old.
Why not higher?
CRITICAL would require either a canonically high-value-role component (the E3 is not one) or evidence that the vulnerability produces fleet-scale, identity-scale, or supply-chain-scale impact. Root on a single video encoder, even with pivot potential, does not meet that threshold. The installed base is too small and the device role too specialized to justify CRITICAL for enterprise patch prioritization purposes. No KEV listing, no exploitation in the wild, and no public PoC further argue against CRITICAL.
Why not lower?
MEDIUM or below would understate the risk for the organizations that *do* have these devices. The exploit chain is trivially weaponizable: download firmware → extract JWT secret → forge admin token → inject command → root shell. Zero authentication, low complexity, no user interaction. For any team with Kiloview E3 units in their inventory, this is an urgent patch. The Scope:Changed vector also means a compromised encoder becomes a pivot point on the production network, which could cascade in flat or poorly segmented environments.
Crowdsourced verification payload.
Run this script from any Linux/macOS workstation that has network access to the Kiloview E3 management interface. Usage: bash check_kiloview_e3.sh 192.168.1.100 — no special privileges required. The script attempts to retrieve firmware version information from the E3 web interface and compares it against the patched version.
#!/usr/bin/env bash
# CVE-2026-110243 — Kiloview E3 NDI Encoder firmware version check
# Usage: bash check_kiloview_e3.sh <E3_IP_OR_HOSTNAME> [PORT]
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN
set -euo pipefail
TARGET="${1:-}"
PORT="${2:-80}"
PATCHED_MAJOR=1
PATCHED_MINOR=30
if [ -z "$TARGET" ]; then
echo "Usage: $0 <E3_IP_OR_HOSTNAME> [PORT]"
echo " PORT defaults to 80"
exit 2
fi
BASE_URL="http://${TARGET}:${PORT}"
# Attempt to retrieve device info from common Kiloview API endpoints
# The E3 typically exposes version info via its web interface
echo "[*] Checking Kiloview E3 at ${BASE_URL} ..."
RESPONSE=""
for ENDPOINT in "/api/system/info" "/api/device/info" "/api/v1/system" "/cgi-bin/get_sys_info" "/system/info"; do
HTTP_CODE=$(curl -s -o /tmp/kv_e3_check.tmp -w "%{http_code}" \
--connect-timeout 5 --max-time 10 \
"${BASE_URL}${ENDPOINT}" 2>/dev/null || echo "000")
if [ "$HTTP_CODE" = "200" ]; then
RESPONSE=$(cat /tmp/kv_e3_check.tmp)
echo "[*] Got response from ${ENDPOINT}"
break
fi
done
# Also try the root page which may contain version info
if [ -z "$RESPONSE" ]; then
HTTP_CODE=$(curl -s -o /tmp/kv_e3_check.tmp -w "%{http_code}" \
--connect-timeout 5 --max-time 10 \
"${BASE_URL}/" 2>/dev/null || echo "000")
if [ "$HTTP_CODE" = "200" ]; then
RESPONSE=$(cat /tmp/kv_e3_check.tmp)
echo "[*] Got response from root page"
fi
fi
rm -f /tmp/kv_e3_check.tmp
if [ -z "$RESPONSE" ]; then
echo "UNKNOWN — Could not connect to Kiloview E3 at ${BASE_URL}"
echo " Verify the device is reachable and the port is correct."
exit 2
fi
# Check if this looks like a Kiloview device
if ! echo "$RESPONSE" | grep -qi -E 'kiloview|E3|firmware|version'; then
echo "UNKNOWN — Response does not appear to be from a Kiloview E3 device."
echo " Manually verify firmware version via the web UI at ${BASE_URL}"
exit 2
fi
# Try to extract firmware version (patterns: 1.30, 1.21.0008, V1.30, etc.)
VERSION=$(echo "$RESPONSE" | grep -oiE '[Vv]?[0-9]+\.[0-9]+[0-9.]*' | head -1 | sed 's/^[Vv]//')
if [ -z "$VERSION" ]; then
echo "UNKNOWN — Found a Kiloview device but could not parse firmware version."
echo " Manually check: ${BASE_URL} — patched version is V1.30 or later."
exit 2
fi
echo "[*] Detected firmware version: ${VERSION}"
# Parse major.minor from version string (e.g., 1.30 from 1.30.0001)
MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
# Compare versions
if [ "$MAJOR" -gt "$PATCHED_MAJOR" ] 2>/dev/null; then
echo "PATCHED — Firmware ${VERSION} is >= 1.30. CVE-2026-110243 is fixed."
exit 0
elif [ "$MAJOR" -eq "$PATCHED_MAJOR" ] && [ "$MINOR" -ge "$PATCHED_MINOR" ] 2>/dev/null; then
echo "PATCHED — Firmware ${VERSION} is >= 1.30. CVE-2026-110243 is fixed."
exit 0
else
echo "VULNERABLE — Firmware ${VERSION} is < 1.30."
echo " CVE-2026-110243: OS command injection in network interface name parameter (root RCE)"
echo " CVE-2026-92450: Hard-coded JWT secret enables unauthenticated exploitation"
echo " Update immediately to V1.30: https://www.kiloview.com/en/download-category/e3-ware/"
exit 1
fi