Kiloview E3 CVE-2026-92450

The required prerequisite is access to the publicly distributed E3 firmware image (available from the vendor's download page) so the attacker can recover the static, device-independent HMAC-SHA256 secret used to sign session JWTs; with that secret, arbitrary (including administrative) tokens can be forged offline. Exploitation then needs only network reachability to the device's authentication endpoint - no valid credentials, no user interaction (PR:N/UI:N). The principal limiting factors are (1) the device's management interface must be network-accessible to the attacker, and (2) the device must run affected firmware, i.e. a version below 1.30; updating to 1.30 rotates/removes the recoverable secret and closes the vector.

This is a credible, fix-promptly issue rather than an inflated high-score. The official CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity attack requiring no privileges and no user interaction, which is fully consistent with the described mechanism: a static HMAC-SHA256 JWT signing secret hardcoded identically across all E3 firmware images. Because the firmware is publicly distributed (the first reference is the vendor's firmware download page), the secret is recoverable by anyone, so the PR:N rating is well supported - forged administrative tokens need no valid credentials. The vuln.today Decision label is 'this_week', and the flaw was reported via CISA's ICS-CERT (icscert) with a published ICS advisory (ICSA-26-295-01), which raises confidence that this is a validated, real-world-relevant issue in operational technology. However, no EPSS probability was supplied, there is no CISA KEV entry, and no PoC or exploit reference appears in the input, so there is no evidence of active exploitation or published exploit code at this time - exploitation here is trivial to develop but not confirmed to be occurring. One signal tension worth noting: the official 4.0 vector rates only confidentiality (VC:H) with VI:N/VA:N, yet the description says forged tokens grant access to 'privileged device functions,' which would normally also allow integrity/availability impact (configuration and stream control) - verify the realized impact scope with the vendor/CISA advisory.

An attacker downloads the publicly available E3 encoder firmware, extracts the hardcoded HMAC-SHA256 secret from the image, and uses it to mint a validly-signed JWT asserting an administrative session. They present this forged token to a network-reachable E3 device and gain privileged access without any credentials. No public exploit or PoC reference is present in the supplied data, but the technique is straightforward given the firmware is openly distributed.