CVE-2026-109122: Kiloview E3 NDI Encoder OS Command Injection

Received

Published 22-10-2026Last modified 22-10-2026

Vulnerability summary

CVE-2026-109122 is a critical (CVSS 9.4) OS Command Injection vulnerability in kiloview e3 firmware.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.4/10

010

Critical · v4.0 (CVE.org)

EPSS scoreNot scoredRisk metrics not yet published.

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

22-10-2026
PublishedVulnerability first disclosed.

Description

The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system commands as root, and the malicious configuration persists across reboots. Successful exploitation could result in full device compromise, including exposure of stored credentials and cryptographic material.

CVSS metrics

4 scores · 2 sources · 2 versions

v4.09.4v3.19.1

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Affected systems

Kiloview1 product

e3 firmware< 1.30

1 vendor · 1 product

References

3 links