Y2Y2
Open Cyber
Public vulnerability disclosure

CVE-2026-92450

Kiloview E3 NDI Encoder Use of Hard-coded Credentials

publishedCWE-798

The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to the publicly distributed firmware can recover this secret and forge arbitrary session tokens, including administrative tokens, without valid credentials, enabling unauthenticated access to privileged device functions.

Investigate in Cyber JSONMarkdown
Technical severity7.5 highCVSS 3.1 · CNA: icscert
Published2026-10-22Source updated 2026-11-02
Collected2026-11-022 attributed sources

Fixes and workarounds

Fix

KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/

Source: CNA: icscert

Affected products and versions

ProductVersionsAuthority
E3 Firmware
Kiloview 		≥ 0; < 1.30 (affected, custom)
1.30 (unaffected)
Other versions: unaffected 		CNA: icscert

Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.

CVSS assessments

Version / scoreVectorAuthority
3.1 / 7.5
high		 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCNA: icscert
4.0 / 8.7
high		 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NCNA: icscert

Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

References