E3 Firmware vulnerabilities
7 known vulnerabilities in E3 Firmware from KiloView. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
E3 Firmware: Use of Hard-coded Credentials
The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to t
- 7.5 High severity
E3 Firmware: Missing Authentication for Critical Functionality
The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this service. A remote, unaut
- 7.5 High severity
E3 Firmware: NULL Pointer Dereference
The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected service stops accepting new connections while the rest of the device continues operating normally, and will recover automat
- 9.9 Critical severity
E3 Firmware: Improper Neutralization of Special Elements used in an OS Command
The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform
- 9.9 Critical severity
E3 Firmware: Improper Neutralization of Special Elements used in an OS Command
The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed
- 9.1 Critical severity
E3 Firmware: Improper Neutralization of Special Elements used in an OS Command
The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to exe
- 7.5 High severity
E3 Firmware: Uncontrolled Resource Consumption
An issue in KiloView Dual Channel 4k HDMI & 3G-SDI HEVC Video Encoder Firmware v.1.20.0006 allows a remote attacker to cause a denial of service via the systemctrl API System/reFactory component.