CVSS 9.9: Kiloview E3 Pre-1.30 Firmware Allows Authenticated Root Command Execution via Hostname

Kiloview E3 NDI encoders running firmware versions before 1.30 contain a critical remote command injection flaw. The system control service fails to sanitize the hostname parameter when users configure device names. This oversight allows authenticated web users to inject operating system commands that execute with root privileges. Security teams managing video encoding infrastructure should verify their firmware versions immediately, as full device compromise is possible through this interface.

How does the vulnerability work?

The flaw resides in the system control service of the affected Kiloview E3 firmware. When a user submits a hostname through the device naming endpoint, the application passes this input directly into a shell command without proper sanitization or quoting. An attacker with valid web credentials can embed special characters within the hostname field. These characters break out of the intended context, allowing the attacker to execute arbitrary operating system commands as the root user.

What is the severity and scope?

The National Vulnerability Database lists CVE-2026-107861 with a CVSS score of 9.9, classifying it as critical. The weakness is categorized under CWE-78, which denotes improper neutralization of special elements used in an OS command. The impact is severe because the executed commands run with root privileges, granting the attacker complete control over the device. This affects all Kiloview E3 firmware versions released before version 1.30, exposing any deployment running older builds to immediate risk.

Is there a confirmed fix available?

The source material identifies the vulnerability in firmware versions before 1.30. No explicit statement confirms that a patch or update has been publicly released or distributed by the vendor. Security teams should monitor official vendor channels for the availability of firmware version 1.30. Until a confirmed update is available and deployed, the device remains vulnerable to exploitation by any authenticated user with access to the naming function.

What are the operational implications?

As Firewall Scoop reported on 2026-10-17 regarding ZoneMinder, authenticated command injection flaws pose high risks to CCTV and video environments. This Kiloview issue follows a similar pattern where trusted access leads to full compromise. Unlike the DrayTek flaw reported on 2026-10-20, which affected end-of-support devices, this Kiloview vulnerability exists in firmware versions before 1.30. Teams must treat authenticated web interfaces on video encoders as high-risk attack surfaces requiring strict access controls.

Detection notes

Teams usually detect command injection by monitoring for unexpected process spawns on the target device. Look for shell processes initiated by the web service user that do not match standard application behavior. Check system logs for commands containing special characters or arguments that appear in the hostname field. Verify that file integrity monitoring alerts trigger when system binaries or configuration files change unexpectedly. Containment moves should focus on isolating the affected encoder from the network to prevent lateral movement while preserving log evidence for forensic analysis.

Background: National Vulnerability Database

The National Vulnerability Database is the U.S. government’s repository of security flaws in software and hardware. It assigns unique identifiers to each issue, allowing organizations to track, prioritize, and remediate risks using standardized references rather than vague descriptions.

Read the full guide: National Vulnerability Database: Meaning, Structure, and Daily Use

What to do and how to stay safe: Kiloview

• Audit all Kiloview E3 encoders to identify devices running firmware versions prior to 1.30.
• Restrict web interface access to the device naming function to essential personnel only.
• Monitor system logs for unusual shell commands or process executions originating from the web service.
• Prepare to isolate affected devices from the network if suspicious activity is detected before an update is available.

Step-by-step guide: Lateral Movement Prevention Checklist for Network Security

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific firmware versions are affected by CVE-2026-107861?

The vulnerability affects Kiloview E3 NDI encoder firmware versions before 1.30.

Do attackers need to authenticate to exploit this flaw?

Yes, an attacker must be an authenticated web user with access to the device naming function.

What is the CVSS score for this vulnerability?

The National Vulnerability Database assigns a CVSS score of 9.9, rating it as critical.