The Kiloview E3 NDI encoder firmware contains a flaw in the system control service that fails to sanitize the hostname parameter accepted by the device naming endpoint. The unsanitized value is passed unquoted to a shell command, allowing an authenticated web user with this function to inject arbitrary operating system commands that execute as root, resulting in complete compromise of the device.

This vulnerability affects Kiloview E3 NDI encoder devices running any firmware version that has not been upgraded to version V1.30 or later. The affected product is the Kiloview E3 firmware, commonly deployed in IP‑based video streaming setups.

The CVSS score of 9.4 classifies the flaw as critical, and while the EPSS score is not available, the lack of a KEV listing does not diminish the potential for exploitation. An attacker who can authenticate to the web interface of the encoder can execute arbitrary commands through the device naming endpoint. The impact spans full device compromise, including data confidentiality, integrity, and availability. There are no known mitigations other than applying the official firmware update.