Kiloview vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-92450 The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static sHigh 8.7 · Oct 22, 2026
• CVE-2026-110825 The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authenticaHigh 8.7 · Oct 22, 2026
• CVE-2026-110243 The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance addresCritical 9.4 · Oct 22, 2026
• CVE-2026-107861 The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passingCritical 9.4 · Oct 22, 2026
• CVE-2026-96616 Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively High 8.3 · Oct 22, 2026
• CVE-2026-109122 The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web managemeCritical 9.4 · Oct 22, 2026
• CVE-2026-1453 A missing authentication for critical function vulnerability in KiloView Encoder Series could allow an unauthenticated attacker to create or delete administratoCritical 9.3 · Jan 29, 2026
• CVE-2025-63560 An issue in KiloView Dual Channel 4k HDMI & 3G-SDI HEVC Video Encoder Firmware v.1.20.0006 allows a remote attacker to cause a denial of service via the systemcHigh 7.5 · Nov 6, 2025
• CVE-2025-9265 A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving them access to state cCritical 10 · Oct 13, 2025
• CVE-2025-8915 Hardcoded TLS private key and certificate in firmware in Kiloview N30 2.02.246 allows malicious adversary to do a Mann-in-the-middle attack via the networkHigh 8.7 · Oct 13, 2025
• CVE-2023-41926 The webserver utilizes basic authentication for its user login to the configuration interface.High 8.8 · Jul 2, 2024
• CVE-2023-41923 The user management section of the web application permits the creation of user accounts with excessively weak passwords, including single-character passwords.High 7.2 · Jul 2, 2024
• CVE-2023-41922 A 'Cross-site Scripting' (XSS) vulnerability, characterized by improper input neutralization during web page generation, has been discovered.High 7.2 · Jul 2, 2024
• CVE-2023-41921 A vulnerability allows attackers to download source code or an executable from a remote location and execute the code without sufficiently verifying the origin Critical 9.8 · Jul 2, 2024
• CVE-2023-41920 The vulnerability allows attackers access to the root account without having to authenticate.Critical 9.8 · Jul 2, 2024
• CVE-2023-41919 Hardcoded credentials are discovered within the application's source code, creating a potential security risk for unauthorized access.Critical 9.8 · Jul 2, 2024
• CVE-2023-41918 A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs.Critical 10 · Jul 2, 2024
• CVE-2023-41917 Inadequate input validation exposes the system to potential remote code execution (RCE) risks.Critical 10 · Jul 2, 2024
• CVE-2024-2162 An OS Command Injection vulnerability in Kiloview NDI allows a low-privileged user to execute arbitrary code remotely on the device with high privileges.High 8.8 · Mar 21, 2024
• CVE-2024-2161 Use of Hard-coded Credentials in Kiloview NDI allows un-authenticated users to bypass authenticationThis issue affects Kiloview NDI N3, N3-s, N4, N20, N30, N40 Critical 9.8 · Mar 21, 2024