The vulnerability occurs when the network management service on Kiloview E3 NDI encoder firmware fails to sanitize the input field used to configure static routes through the web management API. This flaw allows an authenticated web user with route configuration privileges to inject arbitrary operating system commands that are executed as root. Because the malicious configuration persists across reboots, a successful exploitation can lead to full device compromise, exposing stored credentials and cryptographic material.

The affected product is Kiloview E3 NDI Encoder firmware, specifically versions prior to V1.30. Any device running the vulnerable firmware and accessed via the web management API with sufficient permissions is at risk.

The CVSS score is 9.4, indicating very high severity. An EPSS score is not available and the vulnerability is not listed in CISA KEV. Attack requires authenticated access to the web management interface; therefore, the risk is contingent on credential compromise or lax permission controls. Once an attacker injects commands, they gain root access, persist malicious settings, and maintain control after reboot, making the threat significant for organizations that rely on the device for video encoding or transmission.