CVE-2026-107861criticalCWE-78

CVE-2026-107861: falha crítica em Kiloview E3 Firmware

Kiloview E3 NDI Encoder OS Command Injection

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar E3

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.4epss 0.5%
The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary operating system commands as root, resulting in full device compromise.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Produtos afetados
Kiloview · E3 Firmware
CVEs relacionadas — Kiloview E3 Firmware

No mesmo produto, das mais perigosas para as menos.

CVE-2026-110491MEDIUMKiloview E3 NDI Encoder NULL Pointer DereferenceEPSS 0.5%CVE-2026-109122CRITICALKiloview E3 NDI Encoder OS Command InjectionEPSS 0.5%CVE-2026-110243CRITICALKiloview E3 NDI Encoder OS Command InjectionEPSS 0.5%CVE-2026-110825HIGHKiloview E3 NDI Encoder Missing Authentication for Critical FunctionEPSS 0.4%CVE-2026-111100MEDIUMKiloview E3 NDI Encoder Missing Authentication for Critical FunctionEPSS 0.4%CVE-2026-105265MEDIUMKiloview E3 NDI Encoder Path TraversalEPSS 0.4%