Kiloview E3 flaws pair unauthenticated changes with root execution
CISA disclosed nine vulnerabilities in Kiloview E3 NDI Encoder firmware before version 1.30, including unauthenticated configuration changes, information exposure, and command execution.
The encoder’s Open Network Video Interface Forum (ONVIF) service accepts some requests to change hostname, DNS, and time-server settings without checking who sent them. A separate flaw lets a web user with permission to configure static routes run operating-system commands as root, with the malicious configuration persisting across reboots. Other unauthenticated requests reveal device identifiers and account names and privilege levels, which can help attackers prepare targeted credential attacks. Successful exploitation could expose stored credentials and cryptographic material.
If these encoders are reachable by untrusted parties, restricting web logins alone does not close the unauthenticated ONVIF configuration path. Where the command-execution flaw is reached, root-level execution can survive restarts, leaving device-held credentials and cryptographic material in scope.