9 Critical IP KVM Flaws Enable Unauthenticated Root Access Across Four Vendors
9 Critical IP KVM Flaws Enable Unauthenticated Root Access Across Four Vendors
https://thehackernews.com/2026/03/9-critical-ip-kvm-flaws-enable.html
Publish Date: 2026-03-18 07:42:00
Source Domain: thehackernews.com
Cybersecurity researchers have warned about the risks posed by low-cost IP KVM (Keyboard, Video, Mouse over Internet Protocol) devices, which can grant attackers extensive control over compromised hosts.
The nine vulnerabilities, discovered by Eclypsium, span four different products from GL-iNet Comet RM-1, Angeet/Yeeso ES3 KVM, Sipeed NanoKVM, and JetKVM. The most severe of them allow unauthenticated actors to gain root access or run malicious code.
“The common themes are damning: missing firmware signature validation, no brute-force protection, broken access controls, and exposed debug interfaces,” researchers Paul Asadoorian and Reynaldo Vasquez Garcia said in an analysis.
With IP KVM devices enabling remote access to the target machine’s keyboard, video output, and mouse input at the BIOS/UEFI level, successful exploitation of vulnerabilities in these products can expose systems to potential takeover risks, undermining security controls put in place. The list of shortcomings is as follows –
- CVE-2026-32290 (CVSS score: 4.2) – An insufficient verification of firmware authenticity in GL-iNet Comet KVM (Fix being planned)
- CVE-2026-32291 (CVSS score: 7.6) – A Universal Asynchronous Receiver-Transmitter (UART) root access vulnerability in GL-iNet Comet KVM (Fix being planned)
- CVE-2026-32292 (CVSS score: 5.3) – An insufficient brute-force protection vulnerability in GL-iNet Comet KVM (Fixed in version 1.8.1 BETA)
- CVE-2026-32293 (CVSS score: 3.1) – An insecure initial provisioning via unauthenticated cloud connection vulnerability in GL-iNet Comet KVM (Fixed in version 1.8.1 BETA)
- CVE-2026-32294 (CVSS score: 6.7) – An insufficient update verification vulnerability in JetKVM (Fixed in version 0.5.4)
- CVE-2026-32295 (CVSS score: 7.3) – An insufficient rate limiting vulnerability in JetKVM (Fixed in version 0.5.4)
- CVE-2026-32296 (CVSS score: 5.4) – A configuration endpoint exposure vulnerability in…
