Vulnerability Description
The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this service. A remote, unauthenticated attacker can alter the device hostname, redirect DNS resolution, or modify the configured time source, enabling follow on attacks such as traffic interception or certificate validation bypass.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-29
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01
- https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/
FAQ
What is CVE-2026-110825?
CVE-2026-110825 is a vulnerability with a CVSS score of 7.5 (HIGH). The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configu...
How severe is CVE-2026-110825?
CVE-2026-110825 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-110825?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.