CVE-2026-110243: Kiloview E3 NDI Encoder OS Command Injection (pending)

CVE-2026-110243 is a root-level OS command injection in the link maintenance address configuration endpoint of Kiloview E3 NDI encoder firmware, caused by an unvalidated network interface name passed into a shell command, that lets an authenticated web user with network-configuration permission fully compromise the device; NVD has not, as of 2026-10-27, completed its own CVSS scoring or CPE mapping.

CVE-2026-110243 is an OS command injection (CWE-78) in the network management service of Kiloview E3 NDI encoder firmware. NVD's description states the service "fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform the same validation," so "an authenticated web user with permission to configure network settings can exploit this to execute arbitrary operating system commands as root" (NVD).

NVD tracks the CVE with status "Deferred" as of 2026-10-23: the only CVSS data on record is the CISA ICS-CERT-submitted score — CVSS v3.1 9.9 (critical), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, and CVSS v4.0 9.4 (critical) — with no NVD-published independent score or CPE applicability statement yet, so this page does not show a headline severity score rather than presenting that figure as NVD-confirmed (NVD).

CISA's ICS advisory ICSA-26-295-01, published 2026-10-22, bundles CVE-2026-110243 with eight other E3 Firmware flaws affecting the same device — including a related root command-injection bug in the device-naming endpoint, already tracked on this site as CVE-2026-107861, plus a hardcoded HMAC secret and missing-authentication issues in the ONVIF service. The advisory states "successful exploitation of these vulnerabilities could allow an attacker to fully compromise the device," credits researcher Juan Alonso, and records "no known public exploitation specifically targeting these vulnerabilities" as of publication. The fix is Kiloview E3 Firmware 1.30, available from Kiloview's own download page (CISA ICS Advisory ICSA-26-295-01).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-26, and FIRST scores the probability of exploitation at 0.00512 (43.429th percentile) as of 2026-10-27 (CISA KEV, FIRST EPSS).

NVD has not finished its own severity and applicability analysis. In the meantime, operators of Kiloview E3 NDI encoders should upgrade to firmware 1.30 and restrict web-management access to trusted networks, given the device's authenticated-user attack path leads directly to root.

• Unvalidated network interface name in the link maintenance address configuration endpoint is passed into a shell command, letting an authenticated user with network-configuration permission execute arbitrary OS commands as root (CWE-78). — NVD
• NVD status is "Deferred" with CISA ICS-CERT-submitted CVSS v3.1 9.9 and CVSS v4.0 9.4; no NVD-published score or CPE configuration as of 2026-10-23. — NVD
• Bundled with eight other E3 Firmware flaws in the same advisory (including the related CVE-2026-107861); fixed in Kiloview E3 Firmware 1.30; researcher Juan Alonso credited; no known public exploitation as of publication. — CISA ICS Advisory ICSA-26-295-01
• Not present in the CISA KEV catalog as of 2026-10-26. — CISA KEV
• EPSS score is 0.00512 (43.429th percentile) as of 2026-10-27. — FIRST EPSS