CVE-2026-109122 in Kiloview
Summary
by MITRE • 10/23/2026
The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system commands as root, and the malicious configuration persists across reboots. Successful exploitation could result in full device compromise, including exposure of stored credentials and cryptographic material.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified involves a critical input validation failure within the network management service of Kiloview E3 NDI encoder firmware, specifically affecting the static route configuration interface accessible via the web management API. This flaw stems from an insufficient sanitization process applied to user-supplied data when defining static routes through administrative endpoints. The core technical deficiency lies in the application's handling of command-line arguments or system calls that are triggered by these configurations. Instead of strictly validating and escaping special characters, control sequences, or shell metacharacters within the input fields, the service passes them directly to underlying operating system commands with elevated privileges. This lack of proper encoding allows an attacker to inject arbitrary shell commands into the execution context of the network management process.
Exploitation requires a pre-authenticated web user who possesses specific permissions to configure static routes on the device. While this requirement limits the attack surface compared to unauthenticated exploits, it remains significant in environments where internal users or compromised accounts have access to the administrative interface. By crafting a malicious payload within the static route configuration field, an attacker can achieve remote code execution as the root user. The persistence of these configurations across reboots means that once exploited, the backdoor or modified system state remains active even after device restarts, ensuring long-term unauthorized control unless manually remediated by an administrator who is unaware of the compromise.
The operational impact of this vulnerability is severe, leading to full device compromise. An attacker gaining root access can manipulate network traffic, intercept sensitive data transmitted through the encoder, and potentially pivot to other devices on the local network segment. Furthermore, because the device handles professional video streaming often containing proprietary or confidential content, there is a high risk of exposure for stored credentials, API keys, and cryptographic material used for secure communications. This compromises not only the integrity and availability of the encoding service but also the confidentiality of associated systems and data streams that rely on this hardware for transmission.
From a classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection. The persistence mechanism across reboots suggests potential alignment with ATT&CK techniques related to Persistence, such as modifying system configurations or startup scripts to maintain access. To mitigate this risk, immediate firmware updates provided by the vendor should be applied if available, ensuring that input validation logic is hardened against shell metacharacters and injection patterns. In the interim, network segmentation strategies should be employed to restrict access to the management interface of these encoders from untrusted networks. Additionally, enforcing strict role-based access control ensures that only essential personnel have permissions to modify critical system configurations like static routes, thereby reducing the likelihood of successful exploitation by compromised or malicious insider accounts.