The E3 ONVIF device service processes certain informational requests without requiring authentication. This permits an unauthenticated attacker to obtain detailed device identifiers, a list of configured user accounts and their privilege levels, enabling device fingerprinting and credential-based attack planning. The vulnerability is a missing authentication flaw (CWE-306) that can lead to information disclosure.

Kiloview E3 firmware devices are affected. The advisory specifically targets devices running firmware versions prior to V1.30. No other version ranges are provided, so users should verify if their firmware is older than V1.30.

The CVSS score of 6.9 indicates moderate severity. EPSS information is not available, and the vulnerability is not listed in CISA KEV. Attackers can exploit this flaw remotely over the network without authentication, making detection reliant on network monitoring. While no known exploit has been publicly disclosed, the lack of authentication could facilitate credential guessing or brute‑force attacks once the list of privileged accounts is known.