Key points
- CVE-2026-109122 affects Kiloview E3 firmware versions prior to 1.30.
- The vulnerability allows arbitrary command execution as root via the web API.
- Malicious configurations persist across device reboots, complicating remediation.
Kiloview E3 NDI encoders running firmware before version 1.30 contain a critical command injection flaw that exposes devices to full compromise. According to the NVD record for CVE-2026-109122, the network management service fails to sanitize input when configuring static routes through the web management API. This weakness, classified as CWE-78, enables an authenticated web user with specific permissions to inject and execute arbitrary operating system commands.
The impact of this flaw is severe, with a CVSS score of 9.1. Attackers can run commands as the root user, gaining complete control over the device. This access allows them to steal stored credentials and cryptographic material. Crucially, the malicious configuration created by the exploit persists across reboots, meaning the device remains compromised even after a restart. Firmware versions before 1.30 are affected.
What we know
This vulnerability mirrors patterns seen in recent infrastructure tools. As Malware Chronicle reported on 2026-10-22, AWS SAM CLI had a similar OS command injection flaw in Terraform hooks. Similarly, on 2026-10-18, SiteGuard Server Edition suffered a critical root command injection issue. These incidents highlight a recurring risk where developers fail to sanitize inputs in configuration interfaces. The Kiloview flaw specifically targets the static route configuration field, allowing attackers to bypass normal application logic and interact directly with the underlying operating system.
Defender's checklist
- Verify the firmware version on all Kiloview E3 encoders immediately.
- Restrict access to the web management API to trusted administrators only.
- Monitor for unauthorized static route configurations or unexpected command executions.
- Prepare to isolate affected devices if suspicious activity is detected.
What analysts watch for
Teams usually examine web server logs for unusual static route requests or malformed API calls. Analysts should check whether the device has executed unexpected shell commands or created new processes. Persistence mechanisms often involve modifying configuration files, so reviewing recent changes to network settings is essential. Look for signs of credential harvesting or outbound connections to unknown IPs. General behavior for this category involves leveraging authenticated access to escalate privileges, so monitoring for privilege escalation attempts is key.
What to do and how to stay safe: Kiloview
- Update Kiloview E3 firmware to version 1.30 or later once available.
- Audit static route configurations for any unexpected or malicious entries.
- Reset administrative credentials if the device shows signs of compromise.
- Monitor network traffic for anomalies that indicate data exfiltration.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-109122?
It is a critical command injection vulnerability in Kiloview E3 firmware before version 1.30.
How severe is this flaw?
It has a CVSS score of 9.1, rated as critical.
Which firmware versions are affected?
Kiloview E3 Firmware before 1.30 is affected.
