IP KVM Vulnerabilities 2026: 9 CVEs, Root Access Risks & How to Patch

IP KVM Flaws Exposed: What 9 New CVEs Mean for Root Access in 2026

Imagine this: A ransomware gang breaches your data center—not through a phishing email or a misconfigured cloud bucket, but by exploiting a single, unpatched IP KVM device. With root access, they move laterally, encrypt critical servers, and demand millions in ransom. That scenario is hypothetical, but the weak spots behind it are real. In March 2026, researchers at Eclypsium disclosed nine vulnerabilities in four low-cost IP KVM devices. They range from low to critical severity, and the worst could let an attacker who can reach the device on the network take complete control of it without logging in. If your organization relies on remote management tools, this is a wake-up call.

IP KVMs (Keyboard, Video, Mouse over IP) are the invisible backbone of enterprise IT. They allow administrators to remotely control servers, switches, and other hardware as if they were physically present. But their privileged access also makes them a prime target for attackers. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) published the CVE records for these flaws on March 17, 2026, and they are listed in the National Vulnerability Database. This article breaks down the vulnerabilities, how attackers could exploit them, and—most importantly—how to secure your systems before it’s too late.

---

The 9 IP KVM Vulnerabilities: A Breakdown of CVEs

Photo by Tima Miroshnichenko on Pexels

On March 17, 2026, firmware security company Eclypsium published research by Paul Asadoorian and Reynaldo Vasquez Garcia describing nine CVEs in four low-cost IP KVM devices: the GL.iNet Comet (GL-RM1), JetKVM, Sipeed NanoKVM and Angeet/Yeeso ES3. These are single-port devices that Eclypsium says cost between $30 and $100. They are not the rack-mounted enterprise KVM switches from vendors such as Avocent, Raritan or ATEN, and none of the nine affects Dell’s iDRAC. Severity varies a lot, and the two published sets of scores do not agree: Eclypsium’s write-up rates the flaws from 3.1 to 9.8 on CVSS 3.1, while the official CVE records from CISA, which the National Vulnerability Database displays, rate them from 3.7 to 9.1. Below is a summary of the flaws, both scores, and the fix status.

CVE ID	Device	What Is Wrong	CVSS 3.1 (Eclypsium)	CVSS 3.1 (CVE record)	Fixed In
CVE-2026-32290	GL.iNet Comet (GL-RM1)	Firmware checked only against an MD5 hash stored in the same file	4.2	4.7	1.8.2
CVE-2026-32291	GL.iNet Comet (GL-RM1)	Root shell on the UART serial console with no login (needs physical access)	7.6	6.8	1.8.2
CVE-2026-32292	GL.iNet Comet (GL-RM1)	No limit on web login attempts	5.3	7.5	1.8.2
CVE-2026-32293	GL.iNet Comet (GL-RM1)	Certificates fetched during first setup are not verified	3.1	3.7	1.8.2
CVE-2026-32294	JetKVM	Updates checked only against a SHA-256 hash, with no signature	6.7	4.7	0.5.4
CVE-2026-32295	JetKVM	No limit on login attempts	7.3	7.5	0.5.4
CVE-2026-32296	Sipeed NanoKVM	Wi-Fi settings endpoint open without a login	5.4	8.2	2.3.1
CVE-2026-32297	Angeet/Yeeso ES3	Anyone who can reach port 8888 can write files to the device	9.8	7.5	No fix
CVE-2026-32298	Angeet/Yeeso ES3	OS command injection in the cfg.lua script	8.8	9.1	No fix

Fixed versions come from GL.iNet’s security advisory, JetKVM’s 0.5.4 release notes and Sipeed’s NanoKVM changelog. The CVE records list Comet firmware 1.7.2 as the first fix for CVE-2026-32292 and CVE-2026-32293, so 1.8.2 or later covers all four Comet flaws. On the newer CVSS 4.0 scale, the CVE records rate three of the nine (CVE-2026-32292, CVE-2026-32295 and CVE-2026-32297) as critical at 9.3. None of the nine is in CISA’s Known Exploited Vulnerabilities catalog as of its October 8, 2026 update.

Why These Flaws Are So Dangerous

1. Some Need No Login at All: The Angeet ES3 file-write flaw and the NanoKVM Wi-Fi flaw can be used by anyone who can reach the device on the network, with no credentials. The brute-force flaws let an attacker keep guessing passwords until one works.
2. Low Attack Complexity: Four of the nine are scored in their CVE records as low-complexity attacks that need only network access to the device, with no login and no user interaction, so no phishing or social engineering is required.
3. High Impact: Control of a KVM means attackers can:
   • Execute arbitrary commands on connected servers.
   • Steal sensitive data (e.g., credentials, configuration files).
   • Install backdoors or ransomware.
   • Pivot into other parts of the network.

Technical Deep Dive: How the Exploits Work

Here are three of the flaws in more detail, based on Eclypsium’s write-up and the CVE records:

1. CVE-2026-32297 and CVE-2026-32298: Open File Upload and Command Injection in the Angeet ES3

• Flaw: A management program on the device called "Databridge" exposes an /upload endpoint on port 8888 with no authentication, so anyone who can reach it can write files to the device. Separately, the cfg.lua configuration script passes user input straight into an operating system command.
• Exploit: Eclypsium chained the two: overwrite configuration files through the open upload endpoint, then inject commands that run as root. Network access to port 8888 is all an attacker needs.
• Status: No fix is available. Eclypsium says Angeet/Yeeso has committed to fixing the flaws but has not given a timeline, and that any ES3 in use should be isolated from the network right away.

2. CVE-2026-32290 and CVE-2026-32294: Unsigned Firmware Updates in the GL.iNet Comet and JetKVM

• Flaw: The Comet checked new firmware only against an MD5 hash stored in the last 16 bytes of the firmware file itself. JetKVM checked updates only against a SHA-256 hash supplied by the same server as the update. Neither used a cryptographic signature.
• Exploit: An attacker in the middle of the update connection, or one who controls the update server, can change the firmware and recalculate the hash so the device accepts it.
• Status: Fixed in Comet firmware 1.8.2 and in JetKVM 0.5.4, whose release notes list signed releases.

3. CVE-2026-32292 and CVE-2026-32295: No Brute-Force Protection in the GL.iNet Comet and JetKVM

• Flaw: Both login pages accepted unlimited password guesses, with no delays, no tracking of failed attempts and no lockout. On the Comet, the web password is also the SSH password by default. JetKVM uses a single password with no username and, according to Eclypsium, no complexity requirements.
• Exploit: An attacker who can reach the login page keeps guessing until a weak password works, then has full control of the KVM.
• Status: Fixed in Comet firmware 1.8.2 and in JetKVM 0.5.4, which added login rate limiting.

---

How Attackers Could Exploit IP KVM Flaws: Attack Scenarios

Photo by Jakub Zerdzicki on Pexels

IP KVMs are attractive targets because they sit at the intersection of IT and operational technology (OT). A single compromised KVM can give attackers a foothold into data centers, industrial control systems (ICS), or cloud environments. Below are three hypothetical attack scenarios built on the disclosed CVEs.

Scenario 1: Ransomware Attack via Unpatched KVM

1. Initial Access: An attacker scans the internet for exposed IP KVMs using tools like Shodan or Censys. They find an Angeet ES3 with port 8888 reachable (vulnerable to CVE-2026-32297, which has no fix).
2. Exploitation: The attacker writes files to the device without logging in, then uses the command injection flaw (CVE-2026-32298) to run commands as root.
3. Lateral Movement: From the KVM, the attacker types into the connected server as if sitting at its keyboard, or boots it from attacker-supplied media, then deploys ransomware and encrypts critical systems.
4. Impact: The organization faces downtime, data loss, and a ransom demand.

Why This Works:

• Eclypsium says the number of these low-cost KVMs reachable directly from the internet had grown to 1,611 by January 2026.
• A device with no patch available, like the ES3, stays vulnerable until it is isolated or replaced.

Scenario 2: APT Group Targets Data Center Infrastructure

1. Initial Access: An advanced persistent threat (APT) group targets a government agency’s data center. It finds a GL.iNet Comet or JetKVM on old firmware and guesses the web password, since neither device limited login attempts before its fix (CVE-2026-32292, CVE-2026-32295).
2. Persistence: The attackers hide a backdoor on the KVM itself. Eclypsium warns that an attacker who controls a KVM can keep tools there and re-infect the connected machines even after those machines are cleaned up.
3. Data Exfiltration: Using the KVM’s network access, the attackers move laterally to servers containing classified data and exfiltrate it via encrypted channels.
4. Impact: The breach goes undetected for months, resulting in a significant national security compromise.

Why This Works:

• A KVM works below the operating system, so security tools on the connected machine, such as EDR and antivirus, never see it, as Eclypsium points out.
• Weak passwords are easy to guess when nothing limits login attempts.

Scenario 3: Supply Chain Attack via Compromised Firmware

1. Initial Compromise: An attacker breaks into a KVM vendor’s update server, or intercepts the update connection, and injects malicious code into a firmware update.
2. Distribution: Because the device checks only a hash that travels with the update, not a vendor signature, the tampered firmware passes the check (CVE-2026-32290, CVE-2026-32294).
3. Exploitation: Organizations unknowingly install the malicious firmware, which includes a backdoor.
4. Impact: The attacker gains persistent access to all KVMs that installed the update, allowing them to control connected servers and network devices.

Why This Works:

• Eclypsium found that three of the four devices it tested lacked firmware signature verification entirely.
• JetKVM 0.5.4 now ships signed releases, which closes this gap for JetKVM owners who update.

---

Which Vendors and Devices Are Affected?

If your organization uses IP KVMs, you need to determine whether your devices are vulnerable. Below is a checklist to help you identify affected products and take action.

Affected Vendors and Products

Vendor	Affected Models	Vulnerable Firmware Versions	Patch Status
GL.iNet	Comet (GL-RM1)	1.8.1 and earlier	Fixed in 1.8.2
JetKVM	JetKVM	Before 0.5.4	Fixed in 0.5.4
Sipeed	NanoKVM	Before 2.3.1	Fixed in 2.3.1
Angeet / Yeeso	ES3 KVM	All versions	No fix available

How to Check Your Devices

1. Identify Your KVM Model and Firmware Version:
   • Log in to the KVM’s web interface or use the command-line interface (CLI).
   • Navigate to the "System Information" or "About" section to find the model and firmware version.
2. Cross-Reference with CVE Databases:
   • Check the National Vulnerability Database (NVD) for the latest CVE details.
   • Read your vendor’s own notes: GL.iNet’s security advisory, JetKVM’s releases and Sipeed’s NanoKVM changelog.
3. Scan for Vulnerabilities:
   • Use tools like Nessus, OpenVAS, or Qualys to scan your KVMs for known vulnerabilities.
   • Check whether any of your KVMs can be seen from the internet. Eclypsium suggests Shodan searches such as title:JetKVM, title:NanoKVM or title:GLKVM.

Vendor Responses and Patch Status

• GL.iNet: Its security advisory lists firmware 1.8.2 as the fix for the Comet (GL-RM1) and for the GL-RM10, GL-RM10RC and GL-RM1PE models, and strongly advises affected users to upgrade as soon as possible.
• JetKVM: Version 0.5.4, released March 9, 2026, adds login rate limiting and signed releases.
• Sipeed: NanoKVM 2.3.1 (December 26, 2025) rejects Wi-Fi configuration requests unless the device is in access point (AP) mode, and 2.3.6 (March 12, 2026) added password authentication to that page. For the NanoKVM Pro, the Pro changelog shows the same Wi-Fi password protection in version 1.2.14 (March 13, 2026), the version Eclypsium points Pro owners to.
• Angeet/Yeeso: No fix is available. Eclypsium says the vendor has committed to fixing the flaws but has not given a timeline, so isolate or replace ES3 units.

What If Your Vendor Hasn’t Released a Patch?

• Isolate the Device: Place the KVM in a dedicated VLAN with strict access controls.
• Disable Unused Services: Turn off Telnet, FTP, and HTTP. Use HTTPS only.
• Monitor for Suspicious Activity: Set up alerts for failed login attempts or unusual traffic.

---

How to Secure IP KVM Devices: Hardening Steps for Enterprises

Photo by Tima Miroshnichenko on Pexels

Securing IP KVMs requires a combination of immediate actions and long-term hardening. Below is a step-by-step guide to reducing your risk.

Immediate Actions

1. Patch Immediately:
   • Apply vendor patches as soon as they’re available. Prioritize devices exposed to the internet or untrusted networks.
   • Follow CISA’s guidance on patching critical vulnerabilities.
2. Disable Unused Services:
   • Turn off Telnet, FTP, and HTTP. Use HTTPS only for remote access.
   • Disable SNMP if not in use, or restrict it to trusted management networks.
3. Change Default Credentials:
   • Replace default usernames and passwords (e.g., admin:admin) with complex, unique passwords.
   • Enforce password policies (e.g., 12+ characters, no dictionary words).

Long-Term Hardening

1. Network Segmentation

• Isolate KVMs in a Dedicated VLAN: Restrict access to only authorized administrators.
• Keep Them Off the Open Internet: Eclypsium advises never exposing KVMs directly to the internet and reaching them through a VPN you run into the management network, such as WireGuard or Tailscale.
• Use Firewalls: Block unnecessary ports (e.g., TCP 80, 23, 21) and allow only trusted IP addresses.
• Implement Zero Trust: Require multi-factor authentication (MFA) for KVM access, even on internal networks.

2. Authentication and Access Control

• Enable MFA: If your KVM supports it, enable MFA for all administrative access.
• Use Role-Based Access Control (RBAC): Limit permissions to only what’s necessary (e.g., read-only for auditors).
• Rotate Credentials Regularly: Change passwords and SSH keys every 90 days.

3. Monitoring and Logging

• Enable Syslog: Forward logs to a SIEM (e.g., Splunk, ELK, or Graylog) for centralized monitoring.
• Set Up Alerts: Configure alerts for:
  • Failed login attempts.
  • Unusual traffic patterns (e.g., large data transfers).
  • Configuration changes.
• Audit Logs Regularly: Review logs for signs of compromise (e.g., logins from unknown IP addresses).

4. Firmware and Software Updates

• Schedule Quarterly Reviews: Check for firmware updates at least every three months.
• Verify Firmware Integrity: Use checksums or digital signatures to ensure updates haven’t been tampered with.
• Automate Updates: Use tools like Ansible or Puppet to deploy updates across multiple KVMs.

Third-Party Tools and Alternatives

• Vulnerability Scanners:
  • Nessus: Scan for known vulnerabilities in KVMs.
  • OpenVAS: Free, open-source alternative to Nessus.
  • Qualys: Cloud-based vulnerability management.
• Alternative Remote Access Solutions:
  • Software-Defined KVMs: Tools like Apache Guacamole provide remote access without hardware dependencies.
  • Zero-Trust Remote Access: Solutions like Tailscale or Cloudflare Access enforce strict authentication and encryption.

---

The Bigger Picture: Why IP KVMs Are Prime Targets

IP KVMs are often overlooked in cybersecurity strategies, but their privileged access makes them a high-value target for attackers. Here’s why they’re under increasing scrutiny:

1. They Control Critical Infrastructure

• KVMs provide direct access to servers, network devices, and industrial control systems (ICS).
• A single compromised KVM can give attackers control over an entire data center or manufacturing plant.

2. They’re Often Poorly Secured

• Weak Defaults: Eclypsium found that several of the devices it tested ship with authentication turned off until the user enables it.
• Outdated Firmware: Organizations frequently neglect to update KVM firmware, leaving known vulnerabilities unpatched.
• Exposed to the Internet: Eclypsium says the number of these low-cost KVMs reachable directly from the internet had grown to 1,611 by January 2026, making them easy targets for automated attacks.

3. They’re a Stepping Stone for Lateral Movement

• Attackers use KVMs to pivot into other parts of the network. For example:
  • From a KVM, an attacker can access virtualization hosts (e.g., VMware ESXi) and deploy ransomware.
  • In OT environments, a compromised KVM can lead to physical damage (e.g., shutting down industrial processes).

4. They’re Drawing Attention from Attackers and Investigators

• North Korean IT Workers: Microsoft Incident Response has described a case in which remote workers traced to North Korea connected PiKVM devices to employer-provided workstations, controlled them remotely and extracted sensitive information.
• Law Enforcement: Tech YouTuber Jeff Geerling said FBI agents visited him to ask about these devices, Cybernews reported in July 2025.

---

Key Takeaways

• Nine CVEs disclosed by Eclypsium in March 2026 affect four low-cost IP KVMs: the GL.iNet Comet, JetKVM, Sipeed NanoKVM and Angeet/Yeeso ES3. The worst, in the ES3, could let an attacker on the network take over the device without logging in, and it has no fix.
• Attackers could use these flaws to gain initial access, move laterally, and deploy ransomware or steal data. None of the nine is in CISA’s catalog of known exploited vulnerabilities as of October 2026.
• Affected organizations should update GL.iNet, JetKVM and NanoKVM firmware now, isolate or replace Angeet ES3 units, disable unused services, and enforce network segmentation.
• Long-term hardening includes enabling MFA, monitoring logs, and regularly updating firmware.
• IP KVMs are high-value targets because they control critical infrastructure and are often poorly secured.

What You Should Do Now

1. Identify Your KVMs: Check your inventory for affected models and firmware versions.
2. Patch or Isolate: Apply vendor patches or isolate vulnerable devices from untrusted networks.
3. Harden Your Systems: Follow the hardening steps outlined in this article to reduce your risk.
4. Monitor for Threats: Set up alerts for suspicious activity and review logs regularly.

The threat landscape is evolving, and remote management tools like IP KVMs are in the crosshairs. By taking action now, you can prevent your organization from becoming the next victim. A consumer VPN like GhostShield VPN encrypts your own traffic on Wi-Fi you do not trust, but it does not give you a private path to a KVM on your office network. For that, use a VPN you run into the management network, as Eclypsium advises. Stay vigilant—your network’s security depends on it.