Key points
- CVE-2026-109122 affects Kiloview E3 firmware versions prior to 1.30.
- The flaw allows arbitrary command execution as root via the web management API.
- Malicious configurations persist across device reboots, complicating remediation.
An attacker with valid web credentials on a Kiloview E3 NDI encoder can gain complete control of the device. By exploiting a flaw in how static routes are configured, they can run operating system commands with root privileges. This vulnerability, tracked as CVE-2026-109122, carries a critical severity rating of 9.1 from the National Vulnerability Database.
In plain English
The network management service on these encoders does not properly check input data when users set up static routes through the web interface. An attacker who has already logged in and has permission to configure these routes can insert malicious commands instead of valid network settings. The system then executes these commands as the root user, the most privileged account on the device.
The background
This issue impacts Kiloview E3 firmware versions released before 1.30. According to the National Vulnerability Database, the weakness is classified under CWE-78, which relates to improper neutralisation of special elements used in an OS command. Successful exploitation leads to full device compromise. Attackers can access stored credentials and cryptographic material, and because the malicious configuration survives reboots, the backdoor remains active even after the device is restarted.
What changes now
Managed service providers must audit their inventory of Kiloview E3 encoders immediately. Any unit running firmware older than version 1.30 is vulnerable to this command injection flaw. As RedTeam Log reported on 2026-10-20, a critical remote code execution flaw in end-of-support DrayTek routers was patched, but public exploits remain a risk for unupdated devices. Teams should verify their current firmware levels against the vendor’s release notes to determine exposure.
The attacker's path
This vulnerability serves the initial access and privilege escalation stages of an intrusion. The technique relies on an authenticated user abusing a configuration interface that fails to sanitise input. Teams usually see this pattern when application logic trusts user-supplied data without validation. Check whether your monitoring detects unusual command executions or unexpected static route changes. This class of flaw often leads to persistent backdoors, as seen here, where the attacker’s modifications survive system restarts, allowing long-term access without further interaction.
What to do and how to stay safe: Kiloview
- Inventory all Kiloview E3 devices and check their current firmware versions against the 1.30 threshold.
- Restrict access to the web management API, ensuring only authorised personnel can configure static routes.
- Monitor system logs for unusual command executions or unexpected changes to network routing tables.
- Prepare to apply the vendor’s update once it is confirmed available for your specific hardware model.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which devices are affected by CVE-2026-109122?
Kiloview E3 NDI encoders running firmware versions prior to 1.30 are affected.
What can an attacker do with this flaw?
They can execute arbitrary operating system commands as root and persist the configuration across reboots.
Is there a patch available yet?
The source material indicates the flaw exists in firmware before 1.30, implying version 1.30 or later fixes it, but no explicit patch release date is provided in the text.
