Skip to content

Kiloview E3 NDI encoder wave — firmware-hardcoded JWT secret, ONVIF unauthenticated config writes, and three sibling-divergent root command injections (8-GHSA ICSA-26-295-01 coordinated wave)

Source: hourly offensive-security scan, 2026-10-23. The GitHub published feed landed an 8-advisory Kiloview E3 NDI encoder firmware batch at 00:33Z on 2026-10-23, all mirrored from CISA ICSA advisory icsa-26-295-01 (CSAF JSON). Unlike the usual CSA stub shape (see the Oct 20 ADAM-3600 page), every GHSA here ships a full descriptive paragraph — the descriptions themselves are the attack map. Package/version fields are empty (vendor CSAF is the band source; patch pointer is Kiloview's E3 firmware download page). CISA reports no known public exploitation as of this scan — KEV-watch, and the ICSA-to-KEV lag head-start rule applies.

The E3 is a networked video encoder (NDI/RTSP streaming appliance) — the AV-production class of edge device: usually flat-networked into conference/broadcast/production VLANs, rarely scanned, rarely patched, and frequently reachable from ordinary office LANs.

The legs (from the GHSA descriptions)

Unauthenticated / pre-auth:

  • Firmware-hardcoded HMAC-SHA256 session-JWT secret — CVE-2026-92450 / GHSA-29fw-766p-vxq6 (high). The session JWT signing key is a static string compiled into the firmware image, identical across all deployed devices. The firmware is publicly distributed: download it, recover the secret, forge arbitrary session tokens including administrative ones. No credentials, no vulnerability exploitation — the credential is in the download.
  • ONVIF config writes with authentication not enforced — CVE-2026-110825 / GHSA-85f5-fg8c-69fx (high). Hostname, DNS, and NTP configuration operations on the ONVIF device service are writable without authentication regardless of the configured authentication setting. Unauthenticated DNS/NTP redirection = follow-on traffic interception and certificate-validation-bypass pivot.
  • ONVIF unauthenticated account enumeration — CVE-2026-111100 / GHSA-xg55-fcfc-cqx9 (medium). Informational ONVIF requests return detailed device identifiers plus the configured user-account list with privilege levels — a free fingerprint + targeted-credential-attack prep channel.
  • ONVIF malformed-request service crash — CVE-2026-110491 / GHSA-mxp8-hmpp-7pqm (medium). Malformed/incomplete requests stop the ONVIF service accepting connections; self-recovers; repeatable unauth. (Tracked as DoS; noted for the fuzzing surface it proves — the ONVIF parser runs pre-auth.)
  • Non-expiring web session tokens — CVE-2026-96616 / GHSA-vmjx-3j4p-89gv (high). Login-issued tokens have expiration far beyond any reasonable session lifetime — effectively permanent. Intercepted or device-sampled tokens stay valid for an extended period.

Authenticated (any web user with the relevant config permission) — root command injections:

  • Hostname parameter → unquoted shell command — CVE-2026-107861 / GHSA-f3x3-gqxc-76c6 (critical, 9.9). Device-naming endpoint passes hostname unquoted into a shell command; embedded metacharacters = root RCE.
  • Network interface name → shell command, "unlike sibling handlers" — CVE-2026-110243 / GHSA-vjc7-6jcc-fr83 (critical, 9.9). Link maintenance address configuration endpoint fails to validate the interface name before shell use — the advisory explicitly notes sibling handlers perform the same validation.
  • Static-route field → shell command, persists across reboots — CVE-2026-109122 / GHSA-f5fq-95vg-f6g7 (critical, 9.1). Static-route configuration field unsanitized into a shell command; the malicious configuration survives reboot — config-persistence implant, exposure of stored credentials and cryptographic material post-compromise.

Durable operator axes

  1. The public firmware download is a credential source. Hardcoded fleet-wide JWT/HMAC secrets turn a no-cost firmware fetch into admin access for every deployed unit. Standing workflow on any appliance/media device engagement: pull the current and archived firmware images, extract, and grep the filesystem for signing material (strings for JWT-looking literals, embedded secret/key symbols, config defaults). The Sept 16 OT hardcoded-update-key page covers update keys; this leg is the auth-token twin — same rule: install/firmware-material crypto is obfuscation, and one extract compromises the entire fleet. Prove in a lab: forge an admin session JWT on your own unit and hit one privileged endpoint; never against third-party devices.
  2. A configuration setting is not an enforcement point. The ONVIF writes land "regardless of the device's configured authentication setting" — the toggle ships, the code path ignores it. Feature/setting-vs-enforcement battery: for every security checkbox the vendor documents (ONVIF auth, service auth, TLS, rate limits), differential-test the operation with the setting on AND off. Same genealogy as the Advantech SafeEnhancement rule and the Oct 9 NGINX UI enabled_2fa flag-vs-enforcement drift: enumerate the enforcement sites, not the UI toggles.
  3. Sibling-handler divergence is the fingerprint of firmware command injection — and the advisory says it out loud. Two of the three cmdi legs are named-parameter passes into shell commands, and one explicitly contrasts against validating siblings. Firmware web UIs wire many config fields into system()/shell scripts (hostname, interface, route, NTP, DNS, upgrade URL); one handler missing a validator that its siblings have is the normal shape. Sweep: every config-write endpoint on the management plane with shell-metacharacter probes (;/|/`/$()) as a low-priv user, parameter by parameter — do not stop after one endpoint 400s. The validating sibling is also your allowlist oracle: probe what a sibling rejects to learn the grammar the vulnerable field skipped.
  4. Config-surface RCE beats /tmp RCE: persistence. The static-route leg keeps root code execution across reboot because the injection carrier is the persisted configuration itself. When validating, check the persistence question separately (reboot a lab unit and re-check activation) — a config-carrier implant survives the first remediation reflex ("reboot / re-flash config") and is a stronger finding.
  5. ONVIF is a second, weaker management plane on AV/media gear. The Oct 1 wireless-plane page already carries the Anjvision unauth-ONVIF-endpoint-pack precedent; this wave makes it a class: cameras, encoders, and NDI/RTMP gear commonly expose ONVIF with its own parser, its own auth semantics, and its own account-listing surface, independent of the web UI. On any AV/production-network target, speak ONVIF (WS-Discovery for inventory, then device-service requests unauthenticated) separately from the web UI. The account+privilege listing is a ready-made credential-attack prep list; the DNS/NTP write is an interception pivot that also breaks certificate validation downstream.
  6. Non-expiring tokens = permanent credential carriers. On appliances, assume any token you can sample (Referer, logs, support bundles, URL-borne per adjacent waves) never dies; the kill-then-replay battery applies with an effectively infinite TTL.

Validation boundaries (authorized lab/scope only)

  • Lab-owned E3 unit or customer-approved scope only; these are production-broadcast devices — the crash leg takes the streaming service down, so no probing of live AV infrastructure.
  • Firmware extraction and JWT forging against your own lab device only; forged admin token proof limited to one read/config endpoint, reverted.
  • Command-injection proofs: inert marker commands (id > /tmp/marker-class) written into config fields on a lab unit; persistence check via lab reboot only. Never leave implanted config on a shared unit; re-flash after.
  • ONVIF enumeration proofs limited to your own device's account list; never harvest third-party device inventories.