Overview
CVE-2026-109122 is an OS command injection (CWE-78) in the network management service of the Kiloview E3 NDI encoder. One field used when configuring static routes through the web management API is not sanitized. An authenticated user with permission to configure static routes can run arbitrary operating system commands as root.
The CNA scored it CVSS 3.1 9.1 (Critical), vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. CISA covered it in ICS advisory ICSA-26-295-01 on October 22, 2026, alongside other Kiloview E3 flaws.
Affected Products
| Product | Affected | Fixed |
|---|---|---|
| Kiloview E3 NDI Encoder | Firmware before V1.30 | V1.30 |
Impact
- Root-level command execution on the encoder.
- The malicious configuration persists across reboots.
- Possible exposure of stored credentials and cryptographic material, and a foothold on the video or production network.
Exploitation requires high privileges (an authenticated account allowed to edit routes), which limits drive-by attacks but makes weak or default credentials on exposed devices a serious risk. No public exploitation was reported at time of writing.
Mitigation
- Update the firmware to V1.30 or later.
- Do not expose the management interface to the internet; place encoders on an isolated management VLAN.
- Change default credentials and limit which accounts can modify network settings.
- Review static route configuration on existing devices for unexpected or malformed entries.