CVE-2025-63560
📋 TL;DR
A vulnerability in KiloView Dual Channel 4k HDMI & 3G-SDI HEVC Video Encoder firmware allows remote attackers to cause denial of service through the systemctrl API. This affects organizations using KiloView video encoders with vulnerable firmware versions. Attackers can disrupt video encoding services without authentication.
💻 Affected Systems
- KiloView Dual Channel 4k HDMI & 3G-SDI HEVC Video Encoder
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of video encoding functionality, requiring physical reset or firmware reflash to restore functionality.
Likely Case
Temporary denial of service causing video stream interruption until device restart.
If Mitigated
Minimal impact if device is behind firewall with restricted API access.
🎯 Exploit Status
Proof of concept available in GitHub repository showing simple HTTP request to trigger DoS.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://kiloview.com
Restart Required: No
Instructions:
1. Check KiloView website for firmware updates. 2. Download latest firmware. 3. Upload via device web interface. 4. Apply update and verify version.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict network access to KiloView device management interface
iptables -A INPUT -p tcp --dport 80 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
API Access Control
linuxBlock access to vulnerable systemctrl API endpoint
iptables -A INPUT -p tcp --dport 80 -m string --string "systemctrl" --algo bm -j DROP
🧯 If You Can't Patch
- Isolate KiloView devices on separate VLAN with strict firewall rules
- Implement network monitoring for suspicious API requests to systemctrl endpoint
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface at http://device-ip/status or via SSH if availableCheck Version:
curl -s http://device-ip/status | grep -i versionVerify Fix Applied:
Verify firmware version is updated beyond v.1.20.0006 and test systemctrl API endpoint is not accessible📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /systemctrl endpoint
- Device reboot logs without user action
- System factory reset events
Network Indicators:
- HTTP POST requests to device IP on port 80 with systemctrl in payload
- Increased error responses from device
SIEM Query:
source="kiloview_logs" AND (uri_path="/systemctrl" OR message="factory reset" OR message="system reboot")