Multiple IP-KVM Vulnerabilities
view advisory published 2026-03-17
Multiple KVM products (GL-iNet GL-RM1, Angeet ES3 KVM, Sipeed NanoKVM, and JetKVM) are affected by multiple vulnerabilities. The most severe of these vulnerabilities could allow a remote, unauthenticated attacker to take complete control of a vulnerable product.
01
describes (9)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-32298US | — | — | ||
The Angeet ES3 KVM does not properly sanitize user-supplied variables parsed by the 'cfg.lua' script, allowing an authenticated attacker to execute OS-level commands. | ||||
| CVE-2026-32297US | —OT elevated | — | ||
The Angeet ES3 KVM allows a remote, unauthenticated attacker to write arbitrary files, including configuration files or system binaries. Modified configuration files or system bina… | ||||
| CVE-2026-32296US | —OT elevated | — | ||
Sipeed NanoKVM before 2.3.1 exposes a Wi-Fi configuration endpoint without proper security checks, allowing an unauthenticated attacker with network access to change the saved conf… | ||||
| CVE-2026-32295US | — | — | ||
JetKVM before 0.5.4 does not rate limit login requests, enabling brute-force attempts to guess credentials. | ||||
| CVE-2026-32294US | —OT elevated | — | ||
JetKVM prior to 0.5.4 does not verify the authenticity of downloaded firmware files. An attacker-in-the-middle or a compromised update server could modify the firmware and the corr… | ||||
| CVE-2026-32293US | — | — | ||
The GL-iNet Comet (GL-RM1) KVM connects to a GL-iNet site during boot-up to provision client and CA certificates. The GL-RM1 does not verify certificates used for this connection,… | ||||
| CVE-2026-32292US | — | — | ||
The GL-iNet Comet (GL-RM1) KVM web interface does not limit login requests, enabling brute-force attempts to guess credentials. | ||||
| CVE-2026-32291US | —OT elevated | — | ||
The GL-iNet Comet (GL-RM1) KVM before 1.8.2 does not require authentication on the UART serial console. This attack requires physically opening the device and connecting to the UAR… | ||||
| CVE-2026-32290US | —OT elevated | — | ||
The GL-iNet Comet (GL-RM1) KVM before version 1.8.2 does not sufficiently verify the authenticity of uploaded firmware files. An attacker-in-the-middle or a compromised update serv… | ||||
02
references
External citations — patches, advisories, analysis.
03
remediations (9)
- No fix availableES3 KVM
No fix available.
- No fix availableES3 KVM
No fix available.
- FixedComet KVM
Fixed in 1.7.2 and firmware v1.8.1.
https://dl.gl-inet.com/release/kvm/release/RM1/1.7.2 - FixedComet KVM
Fixed in 1.7.2 and firmware v1.8.1.
https://dl.gl-inet.com/release/kvm/release/RM1/1.7.2 - FixedComet KVM
Fixed in 1.8.2.
https://dl.gl-inet.com/release/kvm/release/RM1/1.8.2 - FixedComet KVM
Fixed in 1.8.2.
https://dl.gl-inet.com/release/kvm/release/RM1/1.8.2 - FixedJetKVM
Fixed in 0.5.4.
https://github.com/jetkvm/kvm/releases/tag/release%2F0.5.4 - FixedJetKVM
Fixed in 0.5.4.
https://github.com/jetkvm/kvm/releases/tag/release%2F0.5.4 - FixedNanoKVM
Fix available in 2.3.1.
https://github.com/sipeed/NanoKVM/blob/main/CHANGELOG.md#231-2025-12-26
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan