PatchTheCVECVE-2026-110243: The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network inte
CVE-2026-110243 is a critical-severity flaw (CVSS 9.9) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform the same validation. An authenticated web user with permission to configure network settings can exploit this to execute arbitrary operating system commands as root.
Why this priority
- Critical severity
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.9 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 67%) |
| CISA exploited list | No |
| Weakness | CWE-78 |
| Published | 2026-10-22 |
| Last modified | 2026-10-23 |
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Advisories and coverage
Official advisories
- CISA Alerts and Advisories: Kiloview E3 NDI Encoder 2026-10-22
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-110243?
No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.
Is CVE-2026-110243 being exploited?
CVE-2026-110243 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-110243 affect?
CVE-2026-110243 affects affected software. Severity is critical (CVSS 9.9). The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling ha
How urgent is CVE-2026-110243?
Priority 43/100. Critical severity