CVE-2026-107861

CRITICAL

The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary operating system commands as root, resulting in full device compromise.

CVSS v3.1 Score

9.9
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack Vector
NETWORK
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Published: 10/22/2026Modified: 10/22/2026

Related Intelligence (1)

CRITICALPhishing

Kiloview E3 NDI Encoder

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-01.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of this these vulnerabilities could allow an attacker to fully compromise the device.</strong></p> <p>The following versions of Kiloview E3 NDI Encoder are affected:</p> <ul> <li>E3 Firmware <1.30 (CVE-2026-109

CVE-2026-109122CVE-2026-111100
CISA Advisories

References (3)

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-01.jsonhttps://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/