- CISA published an advisory on October 22 covering nine flaws in Kiloview E3 NDI Encoder firmware older than version 1.30.
- Video gear is easy to overlook, yet it is a networked computer. CISA warns an attacker could take full control of an affected device.
- Find any E3 units, check their firmware version, update to V1.30 as Kiloview advises, and name an owner for non-IT device updates.
The device nobody listed as a computer
A video encoder looks like AV gear. It sits on a shelf or in a rack and does one job. Yet it is also a small computer on your network. It runs an operating system, offers a web login and carries firmware. A security gap there can go unnoticed.
On October 22, CISA, the US cyber agency, published an advisory on the Kiloview E3 NDI Encoder. It covers nine flaws in firmware older than version 1.30. CISA warns that an attacker who exploits them could take full control of the device.
What the advisory says
The nine flaws carry separate CVE IDs. The lowest is CVE-2026-92450 and the highest is CVE-2026-111100. The seven in between are CVE-2026-96616, CVE-2026-105265, CVE-2026-107861, CVE-2026-109122, CVE-2026-110243, CVE-2026-110491 and CVE-2026-110825.
A researcher named Juan Alonso reported the flaws to CISA. Kiloview tells users to update to firmware V1.30. CISA lists the affected sectors as Communications and Information Technology.
Two caveats apply. CISA says it has no report of public exploitation aimed at these flaws. The advisory text we reviewed also gives no severity scores. It does not link each CVE to a weakness type.
How these weaknesses work
CISA names six kinds of weakness across the nine CVEs. Several are long-known coding or design errors rather than exotic attacks.
OS command injection (CWE-78) appears several times. The device takes text from a user and hands it to its operating system as a command. A crafted input can make the device run instructions its owner never intended.
Missing authentication (CWE-306) means a key action needs no login. Hard-coded credentials (CWE-798) means a login is built into the software. The owner did not choose it.
Insufficient session expiration (CWE-613) means a login stays valid longer than it should. Path traversal (CWE-22) lets a request reach files outside its intended folder. A NULL pointer dereference (CWE-476) is a software error that typically crashes a program.
The lesson: ownership is the real gap
This is our interpretation, not CISA's. The notable part of this advisory is the spread of weakness types across one small device, more than any single flaw. Some concern who can log in. Others concern what the device does with the input it receives.
CISA does not say whether these flaws can be chained. It also does not say which of them need a login. So treat the full set as in scope until Kiloview's firmware is applied.
Fixes like this depend on someone knowing the device exists. A server update arrives through an IT process. An encoder update may depend on a media, events or facilities team noticing an advisory.
The advisory does not say how Kiloview customers manage their units. But devices that sit between teams often lack a clear owner.
What to ask your team
Start with inventory. Ask whether the organisation owns any Kiloview E3 units. Ask which firmware version each one runs. Anything before 1.30 is in scope for this advisory.
Then ask about exposure. CISA's general guidance is to keep control system devices off the internet. It also says to place them behind firewalls, apart from business networks.
Where remote access is needed, CISA advises a VPN. It adds that a VPN is only as secure as the devices connected to it.
CISA also reminds organisations to run an impact analysis and risk assessment before deploying defensive measures. If staff see suspected malicious activity, it asks them to follow internal procedures and report to CISA.
Finally, ask who owns the update. Name one person or team responsible for firmware on devices that are not classed as IT. If a unit cannot be updated yet, ask what network controls limit who can reach its management login.
A device that moves video is still a computer. It needs an owner, an inventory entry and a patch date like any other.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: CISA.
