CVE-2026-111100— Kiloview E3 NDI Encoder Missing Authentication for Critical Function
Quick assessment
Affected
Kiloview E3 Firmware
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
E3 设备上的 ONVIF 设备服务在无需身份验证的情况下，会响应某些信息请求。远程未授权的攻击者可以获取详细的设备标识符，以及已配置的用户账户列表及其权限级别。这有助于攻击者对存在漏洞的设备进行指纹识别，并准备针对性的凭证攻击。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-111100
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Kiloview E3 NDI Encoder Missing Authentication for Critical Function
Source: CVE Program / CVE List V5
Vulnerability Description
The ONVIF device service on the E3 responds to certain informational requests without requiring authentication. A remote, unauthenticated party can retrieve detailed device identifiers along with a list of configured user accounts and their privilege levels. This aids attackers in fingerprinting vulnerable devices and preparing targeted credential attacks.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Kiloview | E3 Firmware | 0 ~ 1.30 | - |
|
II. Public POCs for CVE-2026-111100
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-111100
请登录查看更多情报信息。
Same Patch Batch · Kiloview · 2026-10-22 · 9 CVEs total
| CVE-2026-107861 | 9.9 CRITICAL | Kiloview E3 NDI Encoder OS Command Injection |
| CVE-2026-110243 | 9.9 CRITICAL | Kiloview E3 NDI Encoder OS Command Injection |
| CVE-2026-109122 | 9.1 CRITICAL | Kiloview E3 NDI Encoder OS Command Injection |
| CVE-2026-92450 | 7.5 HIGH | Kiloview E3 NDI Encoder Use of Hard-coded Credentials |
| CVE-2026-110825 | 7.5 HIGH | Kiloview E3 NDI Encoder Missing Authentication for Critical Function |
| CVE-2026-110491 | 7.5 HIGH | Kiloview E3 NDI Encoder NULL Pointer Dereference |
| CVE-2026-96616 | 6.5 MEDIUM | Kiloview E3 NDI Encoder Insufficient Session Expiration |
| CVE-2026-105265 | 5.3 MEDIUM | Kiloview E3 NDI Encoder Path Traversal |
IV. Related Vulnerabilities
Same product: E3 Firmware
-
CVE-2026-110825
Kiloview E3 NDI Encoder Missing Authentication for Critical -
CVE-2026-92450
Kiloview E3 NDI Encoder Use of Hard-coded Credentials -
CVE-2026-110243
Kiloview E3 NDI Encoder OS Command Injection -
CVE-2026-107861
Kiloview E3 NDI Encoder OS Command Injection -
CVE-2026-110491
Kiloview E3 NDI Encoder NULL Pointer Dereference
Same vendor: Kiloview
-
CVE-2026-110825
Kiloview E3 NDI Encoder Missing Authentication for Critical -
CVE-2026-92450
Kiloview E3 NDI Encoder Use of Hard-coded Credentials -
CVE-2026-110243
Kiloview E3 NDI Encoder OS Command Injection -
CVE-2026-107861
Kiloview E3 NDI Encoder OS Command Injection -
CVE-2026-110491
Kiloview E3 NDI Encoder NULL Pointer Dereference
Same weakness: CWE-306
-
CVE-2026-19677
Authentication Bypass Leading to Server-Side Command Executi -
CVE-2026-110825
Kiloview E3 NDI Encoder Missing Authentication for Critical -
CVE-2026-83938
Azure Kubernetes Configuration Service Elevation of Privileg -
CVE-2026-13599
ABB Ability Edgenius | Missing Authentication in Edgenius Au -
CVE-2026-114636
Traefik v3.7.13 Authentication Bypass via ssl-passthrough In
V. Comments for CVE-2026-111100
No comments yet