CVE-2026-109122

Summary

An authenticated user with static route configuration privileges can inject OS commands into the web management API's static route field on Kiloview E3 NDI encoders, achieving unauthenticated root RCE that persists across reboots due to insufficient input sanitization.

Exploitability

Exploitation requires valid credentials and the 'configure static routes' permission; otherwise straightforward given the direct command injection point.

Blast radius

Full device compromise is possible, including extraction of stored credentials and cryptographic secrets, enabling lateral movement or persistent backdoor access.

Detection

Monitor web management API logs for POST requests to the static route configuration endpoint containing shell metacharacters (e.g., ';', '|', '$(', '`') in the route parameter; such anomalies are likely indicators of exploitation attempts.

Prioritized remediation

Upgrade to firmware version 2.590 or later, which includes vendor-confirmed input validation fixes for the static route configuration endpoint.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.