CVE-2026-109122: Kiloview E3 NDI Encoder OS Command Injection (pending)

CVE-2026-109122 is a critical OS command injection in the Kiloview E3 NDI video encoder's static-route configuration feature that lets an authenticated web user run arbitrary root commands and persist the malicious configuration across reboots, but NVD's own vulnerability-status field is "Deferred" with no NVD-published Primary score, only a CNA-attributed (ICS-CERT) rating.

CVE-2026-109122 is a CWE-78 (Improper Neutralization of Special Elements used in an OS Command / OS Command Injection) vulnerability in the Kiloview E3, a hardware NDI (Network Device Interface) encoder used in broadcast and AV-over-IP production environments. CISA's ICS advisory describes it precisely: "The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system commands as root, and the malicious configuration persists across reboots. Successful exploitation could result in full device compromise, including exposure of stored credentials and cryptographic material" (CISA ICS Advisory ICSA-26-295-01).

NVD lists this CVE with vulnStatus: Deferred — NVD has performed no independent analysis of its own and published no Primary CVSS score. The only metric on record is a CNA-attributed (ICS-CERT) rating of CVSS v3.1 9.1 (critical), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, and CVSS v4.0 9.4 (critical) from the same CNA source, not from NVD itself, so neither figure is NVD-confirmed; this page records no headline CVSS score until NVD completes its own analysis (NVD).

CISA's advisory states the overall risk evaluation as "Successful exploitation of this these vulnerabilities could allow an attacker to fully compromise the device" (one of nine CVEs disclosed for the E3 in this advisory; this page covers only the most severe, the command-injection flaw). It credits Juan Alonso with reporting the issue to CISA, and states explicitly: "No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time." KiloView's remediation is to "update to V1.30," available from the manufacturer's firmware download page (CISA ICS Advisory ICSA-26-295-01).

As of 2026-10-28, FIRST scores the probability of exploitation at 0.00522 (0.52%), 44.2nd percentile — low, and the CVE is not on CISA's KEV catalog, consistent with CISA's own statement of no known public exploitation; a critical vendor-rated CVSS score with no KEV listing and a low EPSS here should be read as an unscored-but-serious configuration-level exposure, not as evidence of active attacks (FIRST EPSS).

Until NVD completes its own scoring, treat the 9.1/9.4 figures as indicative only, not NVD-confirmed. Any Kiloview E3 on firmware before V1.30 should be updated, and administrators should audit who holds the "configure static routes" web permission given the root-command-execution impact.

• An unsanitized static-route configuration field in the Kiloview E3 NDI encoder's web management API lets an authenticated user with route-configuration permission execute arbitrary OS commands as root, persisting across reboots. — CISA ICS Advisory ICSA-26-295-01
• NVD's vulnStatus for this CVE is Deferred, with no NVD-published Primary score; the only metrics on record (CVSS v3.1 9.1, CVSS v4.0 9.4) are CNA (ICS-CERT) attributed, not NVD's own analysis. — NVD
• CISA states no known public exploitation has been reported, credits Juan Alonso for the report, and the vendor recommends updating to firmware V1.30. — CISA ICS Advisory ICSA-26-295-01
• EPSS score is 0.00522 (0.52%), 44.2nd percentile, as of 2026-10-28; not listed on the CISA KEV catalog. — FIRST EPSS