The Kiloview E3 firmware contains a NULL pointer dereference in the ONVIF service. An unauthenticated attacker can send malformed or incomplete requests to specific operations, causing the service to stop accepting new connections while the rest of the device continues to operate normally. The issue can be triggered repeatedly, leading to intermittent service unavailability without affecting other device functions or revealing sensitive data.

The vulnerability affects Kiloview E3 devices running firmware versions prior to the publicly available V1.30 update. Any deployment of the E3 NDI Encoder that has not been upgraded to the latest firmware is potentially exposed.

The CVSS score of 6.9 indicates a medium severity vulnerability. Exploitation requires only network access and does not require authentication, making the attack vector readily available to any unauthenticated actor on the network. The CISA KEV catalog does not list this issue, and no EPSS score is available at the time of this analysis. Overall, the risk is primarily an availability issue that can repeatedly interrupt the ONVIF service but does not grant attackers broader control or compromise of the device.