CVE-2026-110243

Summary

The Kiloview E3 NDI encoder's link maintenance address configuration endpoint accepts unvalidated network interface names and passes them directly to a shell command, allowing authenticated low-privilege users to achieve remote code execution as root via command injection (CWE-78).

Exploitability

Exploitation requires valid credentials and permission to configure network settings; it is straightforward for an attacker with those privileges due to the lack of input sanitization.

Blast radius

Successful exploitation grants full root-level control of the device, enabling complete compromise of confidentiality, integrity, and availability of the encoder and potential lateral movement within the network.

Detection

Monitor for web access logs showing POST requests to the link maintenance address configuration endpoint with non-standard or suspicious interface names (e.g., containing shell metacharacters like ';', '|', '$('), especially when combined with unexpected outbound connections or unusual process creation events on the device.

Prioritized remediation

Upgrade to firmware version 2.590 or later, which includes validation of network interface names before shell command invocation.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.