OTPulse

Kiloview E3 NDI Encoder

Plan PatchCVSS 9.9ICS-CERT ICSA-26-295-01Oct 22, 2026
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

The Kiloview E3 NDI Encoder contains multiple critical vulnerabilities including OS command injection (CWE-78), missing authentication (CWE-306), improper cryptographic practices (CWE-613), path traversal (CWE-22), null pointer dereference (CWE-476), and hardcoded credentials (CWE-798). Successful exploitation could allow an attacker to fully compromise the device and gain unauthorized control over video encoding and streaming operations.

What this means
What could happen
An attacker with network access could fully compromise the E3 encoder, potentially intercepting or manipulating video streams, disrupting broadcast or surveillance operations, and using the compromised device as a foothold into your network.
Who's at risk
Video streaming and broadcast operators who use Kiloview E3 NDI Encoders for live video distribution, remote production, or surveillance workflows. This includes broadcast facilities, live event producers, corporate video conferencing setups, and surveillance system integrators.
How it could be exploited
An attacker on your network could exploit command injection or authentication bypass vulnerabilities to gain remote access to the E3 encoder. Once compromised, they could execute arbitrary commands, extract credentials stored on the device, or access stored video content and configuration data.
Prerequisites
  • Network access to the E3 encoder (typically HTTP/HTTPS ports)
  • For some attack paths: valid user credentials (though CWE-306 suggests authentication can be bypassed)
  • The device must be running firmware version 1.29 or earlier
remotely exploitablelow complexityhigh CVSS score (9.9)multiple critical vulnerabilitiesaffects video streaming and surveillance infrastructurehardcoded credentials present
Affected products (1)
ProductAffected VersionsFix Status
E3 Firmware<1.30No fix yet
Remediation & Mitigation
0/4
Do now
0/2
HARDENINGRestrict network access to E3 encoder management interfaces to authorized workstations only using firewall rules
HARDENINGChange all default credentials on the E3 device if password reset capability is available
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate E3 firmware to version 1.30 or later from https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/
Long-term hardening
0/1
HARDENINGIsolate the E3 encoder on a separate network segment from general IT infrastructure and restrict inter-VLAN traffic
View full CISA ICS-CERT advisory
API: /api/v1/advisories/a39be85f-e1e8-456c-a75f-1c5b731e48c6

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.