Kiloview E3 CVE-2026-110825

The exact prerequisite is network reachability to the ONVIF device service on a Kiloview E3 NDI encoder running firmware below 1.30; the service accepts hostname, DNS, and NTP configuration write operations without authentication regardless of the device's configured authentication setting for that service, so even devices where ONVIF authentication is enabled remain exploitable. No credentials, user interaction, or non-default configuration is required (PR:N/UI:N/AC:L). The primary limiting factor is network exposure: the device service must be reachable by the attacker, so devices isolated on segmented or firewalled OT/AV networks are not remotely exploitable, and impact is limited to configuration integrity (no direct data disclosure or denial of service), with the most serious consequences being follow-on traffic interception or certificate validation bypass rather than immediate compromise.

This is a genuine, actionable priority rather than a CVSS-inflated non-issue, but the risk is scoped to integrity manipulation rather than direct compromise. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a remote, unauthenticated attack with low complexity and no user interaction against the ONVIF device service - the most favorable conditions for an attacker - and the vector correctly scores only integrity impact (VI:H) with no confidentiality (VC:N) or availability (VA:N) effect, matching a CWE-306 missing-authentication flaw that permits configuration writes but not direct data theft or outage. CISA ICS-CERT reporting (icsa-26-295-01) and a vendor patch raise confidence that the flaw is real and vendor-confirmed. No EPSS score was provided and the vulnerability is NOT in CISA KEV, and no public exploit or PoC reference is present in the input, so there is no evidence of active exploitation or widely available weaponized code. The vuln.today decision label is 'this_week', which aligns with a serious-but-not-emergency posture: unauthenticated network write access is dangerous, but the direct impact is configuration tampering that primarily enables follow-on attacks (traffic interception, certificate validation bypass via DNS/NTP manipulation) rather than immediate code execution. The principal uncertainty is exploitation probability: with no EPSS and no KEV, likelihood of real-world attack cannot be quantified from the provided data.

An attacker with network reachability to a Kiloview E3 encoder sends ONVIF configuration write requests to the device service without any credentials, overriding the device's configured authentication setting. They redirect the device's DNS resolver or NTP time source to attacker-controlled infrastructure, setting up man-in-the-middle traffic interception or certificate validation bypass for the device's subsequent connections. No public exploit code or PoC reference is identified in the available data; exploitation would require crafting ONVIF SOAP requests, which is low-complexity per the CVSS vector.