CVE-2026-107861: Kiloview E3 NDI Encoder OS Command Injection

Severity: critical (CVSS 9.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-22 · updated 2026-10-23
Weakness: CWE-78

Description

The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary operating system commands as root, resulting in full device compromise.

Affected products

Kiloview E3 Firmware: before 1.30 — fixed in 1.30

How to fix

Upgrade to a fixed version: Kiloview E3 Firmware 1.30. Check the vendor advisory for mitigations.

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-01.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01
https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/

Get alerted when CVE-2026-107861 or the next vulnerability affects your stack