CVE-2026-107861: CWE-78 in Kiloview E3 Firmware

The Kiloview E3 firmware contains a command injection flaw (CWE-78) in the system control service's device naming endpoint. The hostname parameter is not sanitized or quoted before being passed into a shell command. An authenticated user with access to this function can inject shell commands, which execute with root privileges, resulting in complete device takeover. The vulnerability has a CVSS 3.1 score of 9.9, indicating critical severity. Affected versions are all firmware versions starting from 0 up to but excluding 1.30. No official patch or remediation details are provided in the available data.

Successful exploitation allows an authenticated attacker to execute arbitrary operating system commands as root on the device, leading to full compromise of the Kiloview E3 NDI encoder. This can result in complete control over the device, potentially impacting confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated access to the device naming endpoint and monitor for suspicious activity. Avoid exposing the management interface to untrusted networks.