Kiloview E3 NDI Encoder
Summary
Multiple critical vulnerabilities have been identified in Kiloview E3 NDI Encoder firmware versions prior to 1.30. Successful exploitation could allow an authenticated attacker to execute arbitrary operating system commands as root, leading to full device compromise. The vulnerabilities include OS Command Injection, Missing Authentication for Critical Functions, and Path Traversal, among others.
IFF Assessment
The identified vulnerabilities allow for full device compromise, posing a significant threat to defenders.
Severity
The CVSS score of 9.9 indicates a critical severity, reflecting the potential for attackers to achieve full device compromise through OS Command Injection and other flaws, with multiple attack vectors and high impact.
Defender Context
Defenders should prioritize patching or mitigating these vulnerabilities in Kiloview E3 NDI Encoder devices to prevent unauthorized access and control. This incident highlights the importance of regularly reviewing firmware updates for critical infrastructure components and understanding the attack vectors associated with networked devices.