CVE-2026-109122: CWE-78 in Kiloview E3 Firmware

The Kiloview E3 firmware contains a command injection vulnerability (CWE-78) in its network management service. Specifically, when an authenticated user with static route configuration permissions uses the web management API, one input field is not sanitized properly. This allows execution of arbitrary operating system commands with root privileges. The exploit persists after reboot, enabling sustained control over the device and access to sensitive information such as credentials and cryptographic keys.

Successful exploitation results in full device compromise with root-level command execution. This includes potential exposure of stored credentials and cryptographic material, which could undermine device security and confidentiality. The persistence of the malicious configuration across reboots increases the severity and impact of the vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the web management API and limit permissions to trusted administrators only. Monitor for unusual configuration changes related to static routes.