CVE-2026-107861

Summary

The Kiloview E3 NDI encoder's device naming endpoint accepts an unsanitized hostname parameter and passes it unquoted into a shell command, allowing authenticated users to execute arbitrary OS commands as root via command injection (CWE-78).

Exploitability

Exploitation requires valid credentials and access to the affected web interface endpoint; no additional complexity or user interaction is needed beyond authentication.

Blast radius

Successful exploitation grants full root-level control of the device, enabling complete data exfiltration, device manipulation, or use as a pivot point within the network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to firmware version 2.590 or later, which includes vendor-confirmed sanitization of the hostname parameter.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.