KiloView vulnerabilities
We track 18 vulnerabilities in KiloView products across 22 products. 18 are rated high or critical, and none are known to be exploited. The most recent was published on October 22, 2026.
Latest KiloView vulnerabilities
- 7.5 High severity
E3 Firmware: Use of Hard-coded Credentials
The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to t
- 7.5 High severity
E3 Firmware: Missing Authentication for Critical Functionality
The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this service. A remote, unaut
- 7.5 High severity
E3 Firmware: NULL Pointer Dereference
The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected service stops accepting new connections while the rest of the device continues operating normally, and will recover automat
- 9.9 Critical severity
E3 Firmware: Improper Neutralization of Special Elements used in an OS Command
The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform
- 9.9 Critical severity
E3 Firmware: Improper Neutralization of Special Elements used in an OS Command
The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed
- 9.1 Critical severity
E3 Firmware: Improper Neutralization of Special Elements used in an OS Command
The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to exe
- 9.8 Critical severity
Encoder Series E1 hardware Version 1.4: Missing Authentication for Critical Functionality
A missing authentication for critical function vulnerability in KiloView Encoder Series could allow an unauthenticated attacker to create or delete administrator accounts. This vulnerability can grant the attacker full administrative control over the product.
- 7.5 High severity
E3 Firmware: Uncontrolled Resource Consumption
An issue in KiloView Dual Channel 4k HDMI & 3G-SDI HEVC Video Encoder Firmware v.1.20.0006 allows a remote attacker to cause a denial of service via the systemctrl API System/reFactory component.
- 10.0 Critical severity
NDI: Improper Authentication
A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving them access to state changing actions that should only be initiated by administratorsThis issue affects Kiloview NDI N30 a
- 8.7 High severity
N30: Exposure of Sensitive Information to an Unauthorized Actor
Hardcoded TLS private key and certificate in firmware in Kiloview N30 2.02.246 allows malicious adversary to do a Mann-in-the-middle attack via the network
- 8.8 High severity
P1/P2: Insufficiently Protected Credentials
The webserver utilizes basic authentication for its user login to the configuration interface. As encryption is disabled on port 80, it enables potential eavesdropping on user traffic, making it possible to intercept their credentials.
- 7.2 High severity
P1/P2: Weak Password Requirements
The user management section of the web application permits the creation of user accounts with excessively weak passwords, including single-character passwords.
- 9.8 Critical severity
P1/P2: Download of Code Without Integrity Check
A vulnerability allows attackers to download source code or an executable from a remote location and execute the code without sufficiently verifying the origin and integrity of the code. This vulnerability can allow attackers to modify the firmware before uplo
- 9.8 Critical severity
P1/P2: Authentication Bypass by Primary Weakness
The vulnerability allows attackers access to the root account without having to authenticate. Specifically, if the device is configured with the IP address of 10.10.10.10, the root user is automatically logged in.
- 10.0 Critical severity
P1/P2: Missing Authentication for Critical Functionality
A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated execute commands potentially leading to unauthorized data manipulation, access to privileged functions, or even the exec
- 10.0 Critical severity
Inadequate input validation exposes the system to potential remote code execution (RCE) risks.
Inadequate input validation exposes the system to potential remote code execution (RCE) risks. Attackers can exploit this vulnerability by appending shell commands to the Speed-Measurement feature, enabling unauthorized code execution.
- 8.8 High severity
NDI: Improper Neutralization of Special Elements used in an OS Command
An OS Command Injection vulnerability in Kiloview NDI allows a low-privileged user to execute arbitrary code remotely on the device with high privileges. This issue affects Kiloview NDI N3, N3-s, N4, N20, N30, N40 and was fixed in Firmware version 2.02.0227 .
- 9.8 Critical severity
NDI: Use of Hard-coded Credentials
Use of Hard-coded Credentials in Kiloview NDI allows un-authenticated users to bypass authenticationThis issue affects Kiloview NDI N3, N3-s, N4, N20, N30, N40 and was fixed in Firmware version 2.02.0227 .