CVE-2023-41919 is a critical severity (CVSS 9.8) hardcoded credentials flaw in the firmware of Kiloview P1 and P2 4G video encoders. The Dutch NCSC says the vendor chose not to fix it in the latest firmware and gave no timeline. Isolate the devices from untrusted networks and decide whether to keep using them.
What's affected
The NVD record names the Kiloview P1 and P2 hardware and their firmware, with no version range. The Dutch NCSC advisory NCSC-2024-0273 (published 2 July 2024), which we read, covers these devices and ten CVEs in all.
NCSC-NL says the vendor decided not to fix the flaws in the most recent firmware and gave no indication of a fix date. The vendor did release updates to its central server systems, according to NCSC-NL, to limit abuse there.
The record scores the flaw 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It can be reached over the network, the attack complexity is low, it requires no privileges, and it needs no user interaction. The impact on confidentiality is high, on integrity high and on availability high. The weakness class is CWE-798 (use of hard-coded credentials). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
Source difference: the record scores this 9.8 (Critical), while NCSC-NL lists the advisory priority as Normal and does not give a score. Plan around the 9.8 vector, which needs no privileges or user interaction, and read the advisory for context.
How to check if you're exposed
Check whether you have a Kiloview P1 or P2 anywhere, including edge and field sites. If you do, find out whether its web interface is reachable from the internet or from broad internal networks. The NCSC says there is no encryption on the configuration web interface, so anyone on the path could capture credentials.
Because the vendor has not released a fix, there is no version to compare with. The question is exposure and replacement.
What to do now
- Inventory all Kiloview P1 and P2 devices.
- Take them off the internet and off shared networks; put them on a segment with strict access rules.
- Make a risk decision, as NCSC-NL advises, about continuing to use them.
- Ask Kiloview for current guidance and watch for firmware that addresses the issue.
- Plan replacement if the devices cannot be isolated.
Why it matters
The weakness is CWE-798, use of hard-coded credentials. A credential built into firmware is the same on every unit, so anyone who learns it can sign in to any device that is reachable. It cannot be rotated by the owner, which is why isolation is the only control left.
The NCSC says the combination of flaws in these encoders could allow full takeover and control of the streaming data. The record does not flag this CVE in the CISA KEV catalog, and we found no statement that it is exploited.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a fix for CVE-2023-41919?
NCSC-NL says the vendor decided not to fix it in the latest firmware and gave no date. Check with the vendor for news.
What is the best control now?
Remove the devices from untrusted networks, segment them, and consider replacing them.
Sources
Last reviewed: 19 October 2026.
