CVE-2026-107861: Kiloview E3 NDI Encoder Root Command Injection (pending)

CVE-2026-107861 is a root-level OS command injection in the device-naming endpoint of Kiloview E3 NDI encoder firmware, caused by an unsanitized hostname parameter passed unquoted into a shell command, that lets an authenticated web user fully compromise the device; NVD has not, as of 2026-10-22, completed its own CVSS scoring or CPE mapping.

CVE-2026-107861 is an OS command injection (CWE-78) in the system control service of Kiloview E3 NDI encoder firmware. NVD's description states the service "fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command," so "an authenticated web user with access to this function can embed characters to execute arbitrary operating system commands as root, resulting in full device compromise" (NVD).

NVD tracks the CVE with status "Deferred" as of 2026-10-23: the only CVSS data on record is the CISA ICS-CERT-submitted score — CVSS v3.1 9.9 (critical), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, and CVSS v4.0 9.4 (critical) — with no NVD-published independent score or CPE applicability statement yet, so this page does not show a headline severity score rather than presenting that figure as NVD-confirmed (NVD).

CISA's ICS advisory ICSA-26-295-01, published 2026-10-22, bundles CVE-2026-107861 with eight other E3 Firmware flaws affecting the same device (including two further CWE-78 root command-injection bugs, a hardcoded HMAC secret, and missing-authentication issues in the ONVIF service), states "successful exploitation of these vulnerabilities could allow an attacker to fully compromise the device," credits researcher Juan Alonso, and records "no known public exploitation specifically targeting these vulnerabilities" as of publication. The fix is Kiloview E3 Firmware 1.30, available from Kiloview's own download page (CISA ICS Advisory ICSA-26-295-01).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-26, and FIRST scores the probability of exploitation at 0.00512 (43.362th percentile) (CISA KEV, FIRST EPSS).

NVD has not finished its own severity and applicability analysis. In the meantime, operators of Kiloview E3 NDI encoders should upgrade to firmware 1.30 and restrict web-management access to trusted networks, given the device's authenticated-user attack path leads directly to root.

• Unsanitized hostname parameter in the device-naming endpoint is passed unquoted into a shell command, letting an authenticated web user execute arbitrary OS commands as root (CWE-78). — NVD
• NVD status is "Deferred" with CISA ICS-CERT-submitted CVSS v3.1 9.9 and CVSS v4.0 9.4; no NVD-published score or CPE configuration as of 2026-10-23. — NVD
• Bundled with eight other E3 Firmware flaws in the same advisory; fixed in Kiloview E3 Firmware 1.30; researcher Juan Alonso credited; no known public exploitation as of publication. — CISA ICS Advisory ICSA-26-295-01
• Not present in the CISA KEV catalog as of 2026-10-26. — CISA KEV
• EPSS score is 0.00512 (43.362th percentile) as of 2026-10-26. — FIRST EPSS