CVE-2026-96616— Kiloview E3 NDI Encoder Insufficient Session Expiration
Quick assessment
Affected
Kiloview E3 Firmware
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
E3 设备的 Web 管理界面在用户登录时颁发的认证令牌，其过期时间被设定为远超合理会话生命周期的数值，导致这些令牌实际上永不过期。通过拦截或设备被攻陷而获取的令牌，可在长时间内持续用于进行已认证的访问。
Possible ATT&CK Techniques 2 AI
T1550.004 · Web Session Cookie T1528 · Steal Application Access Token
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-96616
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Kiloview E3 NDI Encoder Insufficient Session Expiration
Source: CVE Program / CVE List V5
Vulnerability Description
Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them non-expiring. A token obtained through interception or device compromise remains valid for authenticated access for an extended period.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的会话过期机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Kiloview | E3 Firmware | 0 ~ 1.30 | - |
|
II. Public POCs for CVE-2026-96616
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-96616
请登录查看更多情报信息。
Same Patch Batch · Kiloview · 2026-10-22 · 9 CVEs total
| CVE-2026-107861 | 9.9 CRITICAL | Kiloview E3 NDI Encoder OS Command Injection |
| CVE-2026-110243 | 9.9 CRITICAL | Kiloview E3 NDI Encoder OS Command Injection |
| CVE-2026-109122 | 9.1 CRITICAL | Kiloview E3 NDI Encoder OS Command Injection |
| CVE-2026-92450 | 7.5 HIGH | Kiloview E3 NDI Encoder Use of Hard-coded Credentials |
| CVE-2026-110825 | 7.5 HIGH | Kiloview E3 NDI Encoder Missing Authentication for Critical Function |
| CVE-2026-110491 | 7.5 HIGH | Kiloview E3 NDI Encoder NULL Pointer Dereference |
| CVE-2026-111100 | 5.3 MEDIUM | Kiloview E3 NDI Encoder Missing Authentication for Critical Function |
| CVE-2026-105265 | 5.3 MEDIUM | Kiloview E3 NDI Encoder Path Traversal |
IV. Related Vulnerabilities
Same product: E3 Firmware
-
CVE-2026-110825
Kiloview E3 NDI Encoder Missing Authentication for Critical -
CVE-2026-92450
Kiloview E3 NDI Encoder Use of Hard-coded Credentials -
CVE-2026-110243
Kiloview E3 NDI Encoder OS Command Injection -
CVE-2026-107861
Kiloview E3 NDI Encoder OS Command Injection -
CVE-2026-110491
Kiloview E3 NDI Encoder NULL Pointer Dereference
Same vendor: Kiloview
-
CVE-2026-110825
Kiloview E3 NDI Encoder Missing Authentication for Critical -
CVE-2026-92450
Kiloview E3 NDI Encoder Use of Hard-coded Credentials -
CVE-2026-110243
Kiloview E3 NDI Encoder OS Command Injection -
CVE-2026-107861
Kiloview E3 NDI Encoder OS Command Injection -
CVE-2026-110491
Kiloview E3 NDI Encoder NULL Pointer Dereference
Same weakness: CWE-613
-
CVE-2026-115362
OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole -
CVE-2026-115356
OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth -
CVE-2026-54238
Supabase Realtime: Expired JWTs with string exp are accepted -
CVE-2026-89035
MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authent -
CVE-2025-0326
Improper Token Revocation in WSO2 Identity Server Allows Una
V. Comments for CVE-2026-96616
No comments yet