CyberzSOC

Publication detail
← Back to advisories & guidance

ICSA-26-029-01: KiloView Encoder Series (Update A) ↗ source

January 29, 2026 CISA ICS Advisory
Source: https://www.cisa.gov/news-events/ics-advisories/icsa-26-029-01

Summary

Successful exploitation of this vulnerability could allow an unauthenticated attacker to create or delete administrator accounts, granting full administrative control. CVE-2026-1453: A missing authentication for critical function vulnerability in KiloView Encoder Series could allow an unauthenticated attacker to create or delete administrator accounts. This vulnerability can grant the attacker full administrative control over the product.

Advisory Details CISA ICS CSAF feed

Advisory ID
ICSA-26-029-01
Status
Final · version 2
Initial release
2026-01-29
Last revised
2026-02-05 (2 revisions)
Vendor
KiloView
Critical infrastructure sectors
Communications, Information Technology
Deployed
Worldwide
Vendor headquarters
China

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Credit: Muhammad Ammar (0xam225)

Affected products (10)
  • Encoder Series E1 hardware Version 1.4 — Software_4.7.2516
  • Encoder Series E1 hardware Version 1.6.20 — 4.7.2511|4.8.2523|4.8.2611|4.6.2400|4.7.2512|4.8.2561|4.8.2554|4.3.2029|4.8.2555|4.6.2408
  • Encoder Series E1-s hardware Version 1.4 — 4.7.2516|4.8.2519|4.8.2525|4.8.2611|4.8.2561|4.8.2554|4.8.2523
  • Encoder Series E2 hardware Version 1.7.20 — 4.8.2611|4.8.2561
  • Encoder Series E2 hardware Version 1.8.20 — 4.8.2523|4.8.2611|4.8.2554
  • Encoder Series G1 hardware Version 1.6.20 — Software_4.8.2561
  • Encoder Series P1 hardware Version 1.3.20 — 4.8.2633|4.8.2608
  • Encoder Series P2 hardware Version 1.8.20 — Software_4.8.2633
  • Encoder Series RE1 hardware Version 2.0.00 — Software_4.7.2513
  • Encoder Series RE1 hardware Version 3.0.00 — 4.8.2519|4.8.2561|4.8.2611|4.8.2525
Revision history (2)
  • 2026-02-05 — v2: Update A - Affected products are end-of-life
  • 2026-01-29 — v1: Initial Publication

From CISA's machine-readable CSAF 2.0 advisory (JSON).

Vulnerabilities as Stated by the Advisory

CVEWeaknessCVSS v3Details
CVE-2026-1453 CWE-306 Missing Authentication for Critical Function 9.8 Critical A missing authentication for critical function vulnerability in KiloView Encoder Series could allow an unauthenticated attacker to create or delete administrator accounts. This vulnerability can grant the attacker full administrative control over the product. CISA SSVC — Exploitation: None · Automatable: Yes · Impact: Total

Mitigation: KiloView states that these specific hardware versions are end-of-life; therefore, no patches will be released due to hardware limitations. KiloView recommends that users implement mitigation measures such as network isolation or upgrade to newer hardware gene…

Mitigation: Users of affected versions of KiloView Encoder Series are invited to contact KiloView customer support at https://www.kiloview.com/contact/ for additional information. ↗

Affected, fixed & timeline

Affected:

  • Encoder Series E1 hardware Version 1.4 Software_4.7.2516
  • Encoder Series E1 hardware Version 1.6.20 4.7.2511|4.8.2523|4.8.2611|4.6.2400|4.7.2512|4.8.2561|4.8.2554|4.3.2029|4.8.2555|4.6.2408
  • Encoder Series E1-s hardware Version 1.4 4.7.2516|4.8.2519|4.8.2525|4.8.2611|4.8.2561|4.8.2554|4.8.2523
  • Encoder Series E2 hardware Version 1.7.20 4.8.2611|4.8.2561
  • Encoder Series E2 hardware Version 1.8.20 4.8.2523|4.8.2611|4.8.2554
  • Encoder Series G1 hardware Version 1.6.20 Software_4.8.2561
  • Encoder Series P1 hardware Version 1.3.20 4.8.2633|4.8.2608
  • Encoder Series P2 hardware Version 1.8.20 Software_4.8.2633
  • Encoder Series RE1 hardware Version 2.0.00 Software_4.7.2513
  • Encoder Series RE1 hardware Version 3.0.00 4.8.2519|4.8.2561|4.8.2611|4.8.2525

Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVECVSSAffected
CVE-2026-1453 9.3 Critical KiloView Encoder Series E1 hardware Version 1.4 A missing authentication for critical function vulnerability in KiloView Encoder Series could allow an unauthenticated attacker to create or delete a…

Named by the advisory itself. Each CVE links to its tracked detail page.

Vendors Named in This Publication

No KEV-catalogued vendors are named in this publication.