CVE-2026-111100
Kiloview E3 NDI Encoder Missing Authentication for Critical Function
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Public exploit
- None on Exploit-DB
Summary
The Kiloview E3 NDI encoder's ONVIF device service is affected. An unauthenticated remote attacker can retrieve detailed device identifiers and the list of user accounts with their privilege levels, which could help them identify the device and prepare targeted password attacks.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The ONVIF device service on the E3 responds to certain informational requests without requiring authentication. A remote, unauthenticated party can retrieve detailed device identifiers along with a list of configured user accounts and their privilege levels. This aids attackers in fingerprinting vulnerable devices and preparing targeted credential attacks.
Affected versions
- Kiloview E3 Firmware
fixed in 1.30