The vulnerability allows an authenticated web user with permission to configure network settings to inject arbitrary operating system commands via the network interface name field. The network management service neglects to validate this input before passing it to a shell command, enabling execution as root. This represents an OS Command Injection weakness (CWE-78) that can compromise the entire encoder, compromising confidentiality, integrity, and availability.

Any Kiloview E3 NDI Encoder firmware versions below V1.30 are vulnerable. The affected product is Kiloview E3 Firmware, and the issue resides in the link maintenance address configuration endpoint of the web interface.

The CVSS base score of 9.4 reflects a high severity for remote code execution with full privileges. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, but the vulnerability would be readily exploitable once authenticated. The vulnerability has not entered the CISA KEV catalog, indicating no confirmed common exploits yet. The attack vector is remote via the web interface, requiring legitimate credentials with network configuration rights, after which an attacker can run arbitrary commands with root privileges.