CVE-2026-92450: Kiloview E3 NDI Encoder Use of Hard-coded Credentials

Received

Published 22-10-2026Last modified 22-10-2026

Vulnerability summary

CVE-2026-92450 is a high (CVSS 8.7) Use of Hard-coded Credentials vulnerability in kiloview e3 firmware.

Overall risk

35/100

0100

Medium · default modelHow is this calculated?

CVSS score

8.7/10

010

High · v4.0 (CVE.org)

EPSS scoreNot scoredRisk metrics not yet published.

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

22-10-2026
PublishedVulnerability first disclosed.

Description

The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to the publicly distributed firmware can recover this secret and forge arbitrary session tokens, including administrative tokens, without valid credentials, enabling unauthenticated access to privileged device functions.

CVSS metrics

4 scores · 2 sources · 2 versions

v4.08.7v3.17.5

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-798Use of Hard-coded CredentialsThe product contains hard-coded credentials, such as a password or cryptographic key.

Affected systems

Kiloview1 product

e3 firmware< 1.30

1 vendor · 1 product

References

3 links