# CVE-2026-92450: Kiloview E3 NDI Encoder Use of Hard-coded Credentials

Status: published. Published: 2026-10-22. Updated: 2026-11-02.

The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to the publicly distributed firmware can recover this secret and forge arbitrary session tokens, including administrative tokens, without valid credentials, enabling unauthenticated access to privileged device functions.

## Remediation

- fix: KiloView recommends users update to V1.30:  https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ (source: CNA: icscert)

## Affected products and versions

- Kiloview / E3 Firmware: ≥ 0; < 1.30 (affected, custom); 1.30 (unaffected). Source: CNA: icscert

## Severity and prioritization

- CVSS 3.1: 7.5 (high); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N; source: CNA: icscert

- CVSS 4.0: 8.7 (high); CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N; source: CNA: icscert

- CISA KEV: No listing in collected sources

- EPSS: 0.38% as of 2026-11-01; percentile 31.52%

- SSVC: exploitation none; automatable yes; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-798

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ (CNA: icscert)

- https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01 (CNA: icscert)

- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-01.json (CNA: icscert)

## Provenance

- CNA: icscert: https://www.cve.org/CVERecord?id=CVE-2026-92450; retrieved 2026-11-02; source updated 2026-11-02

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-92450; retrieved 2026-11-02; source updated Not reported

Revision: 608e3354f71b85d6bb700f387863faafcac1d1c07947e336e75f8babe28c7465

Canonical: https://y2.dev/cve/CVE-2026-92450