Vulnerability · Published Oct 22, 2026 · Assigned by icscert
CVE-2026-92450Kiloview E3 NDI Encoder Use of Hard-coded Credentials
High 7.5
In plain English
A high-severity hard-coded credentials in E3 Firmware from Kiloview. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Official description
The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to the publicly distributed firmware can recover this secret and forge arbitrary session tokens, including administrative tokens, without valid credentials, enabling unauthenticated access to privileged device functions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Kiloview | E3 Firmware | 0 – before 1.30 |
Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N