Researchers disclose nine IP KVM vulnerabilities across four vendors
Summary
Eclypsium disclosed nine vulnerabilities in IP KVMs from four manufacturers; the most severe can allow unauthenticated root access or malicious code execution. Some flaws remain unpatched.
Key points
- Eclypsium disclosed nine vulnerabilities affecting IP KVM products from GL.iNet, Angeet/Yeeso, Sipeed, and JetKVM.
- The most severe listed flaws affect the Angeet/Yeeso ES3 KVM: CVE-2026-32297 has a CVSS score of 9.8 and CVE-2026-32298 scores 8.8; no fixes were available as of Tuesday.
- The GL.iNet Comet RM-1 has four listed flaws. Two were fixed in v1.8.1 BETA, while fixes for two others were still being planned.
- Sipeed fixed the NanoKVM configuration endpoint exposure in NanoKVM v2.3.1 and NanoKVM Pro 1.2.4; JetKVM fixed its two listed flaws in version 0.5.4.
- A scan by runZero's HD Moore found more than 1,300 internet-exposed IP KVMs, up from about 1,000 the previous June. Researchers recommend scanning networks for the devices and securing them with strong passwords and a reputable VPN.
Article Details
- Vulnerability Types
- Insufficient firmware authenticity verification
- UART root access
- Insufficient brute-force protection
- Insecure initial provisioning via unauthenticated cloud connection
- Unauthenticated file vulnerability
- OS command injection
- Configuration endpoint exposure
- Insufficient update verification
- Insufficient rate limiting
- Severity
- CVSS 3.1 scores range from 3.1 to 9.8; the highest score is 9.8.
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- partial
- Workarounds
- Secure the devices with a strong password and use a reputable VPN.
MITRE ATT&CK
People
HD MooreSecurity expert and runZero founder and CEO who conducted an Internet scan that found more than 1,300 IP KVMs.Paul AsadoorianEclypsium researcher who co-wrote the comments on the disclosed IP KVM vulnerabilities; he also made scanning tools available.Reynaldo Vasquez GarciaEclypsium researcher who co-wrote the comments on the disclosed IP KVM vulnerabilities.