The identified vulnerability pertains to the E3 firmware’s web management interface. Authentication tokens issued on login are given an expiration time that far exceeds reasonable session lifetimes, effectively making them non‑expiring. A token captured through network interception or obtained by compromising the device would grant authenticated access for an extended period, potentially providing an attacker persistent access to the device’s functionality.

Kiloview’s E3 firmware is affected. Users running earlier firmware versions that use this web interface are at risk until they upgrade to the recommended V1.30 release or later.

With a CVSS score of 8.3 the vulnerability is considered high severity. Although no EPSS score is available and the issue is not listed in the CISA KEV catalog, the lack of exposure of a discovery mechanism suggests potential for exploitation via web interface access. The likely attack vector is inferred to be either network interception of authentication traffic or physical/device compromise granting access to the web interface. Once a token is obtained, it can be reused for a prolonged period, enabling continued unauthorized control over the device.