A missing authentication flaw in KiloView Encoder Series allows anyone who can reach the device to create or delete administrator accounts, which grants complete administrative control. The weakness is a lack of authentication for a critical function (CWE‑306). An attacker could configure the device, exfiltrate or alter data, or disable services, compromising confidentiality, integrity, and availability at the device level.

Affected hardware includes the KiloView Encoder Series models E1 (hardware versions 1.4 and 1.6.20), E1‑s (1.4), E2 (1.7.20 and 1.8.20), G1 (1.6.20), P1 (1.3.20), P2 (1.8.20), and RE1 (2.0.00 and 3.0.00).

The CVSS score of 9.3 indicates a high‑severity vulnerability, while the EPSS score shows a very low current exploitation probability (<1%). The vulnerability is not listed in CISA’s KEV catalog. Exploitation likely requires network access to the device’s management interface; an attacker could trigger the flaw by issuing directed requests that create or delete administrative accounts without needing prior authentication.