Anyone running a Kiloview E3 NDI encoder, a box that sends video over a network, on firmware older than 1.30 should update to version 1.30. The vendor recommends that update as the mitigation for all nine vulnerabilities in an advisory published October 22.
The advisory lists nine CVE identifiers (public tracking numbers for known flaws) and gives the device a vendor-equipment score of 9.9 out of 10 on version 3 of CVSS, the standard severity scale. It describes six of the nine in detail. Those six are rated lower than 9.9. The highest is CVE-2026-109122 at 9.1 under CVSS 3.1 and 9.4 under CVSS 4.0. The advisory does not explain the gap. It could come from one of the three undescribed flaws or from how the bugs combine, but the text does not say.
CVE-2026-109122 lets a logged-in user with permission to configure static routes run operating system commands as root through an unsanitized field. The malicious setting survives reboots. CVE-2026-107861 does the same through the hostname field. Two of the described flaws need no login. One leaks device identifiers plus a list of user accounts and their privilege levels (5.3 under CVSS 3.1). The other lets anyone with network access knock the ONVIF service offline by sending malformed requests, though it recovers on its own (7.5 under CVSS 3.1).
The individual scores understate the picture if the bugs are chained, which is our reading rather than the advisory's. An account list gives an attacker names to target. Authentication tokens that effectively never expire, CVE-2026-96616, keep a stolen login useful for far longer. A logged-in account with the right permissions then reaches root. The advisory says successful exploitation could expose stored credentials and cryptographic material.
Command injection in the web management pages of network gear is a familiar bug class, and it tends to matter most where those pages are reachable from outside. The advisory lists the device as deployed worldwide in the communications and IT sectors. The open question is which of the three undescribed flaws, if any, accounts for the 9.9.