Researchers disclose vulnerabilities in IP KVMs from four manufacturers

Researchers disclose vulnerabilities in IP KVMs from four manufacturers - Ars Technica Skip to content Text settings Story text Size Small Standard Large Width * Standard Wide Links Standard Orange * Subscribers only Learn more Minimize to nav Researchers are warning about the risks posed by a low-cost device that can give insiders and hackers unusually broad powers in compromising networks. The devices, which typically sell for $30 to $100, are known as IP KVMs. Administrators often use them to remotely access machines on networks. The devices, not much bigger than a deck of cards, allow the machines to be accessed at the BIOS/UEFI level, the firmware that runs before the loading of the operating system. This provides power and convenience to admins, but in the wrong hands, the capabilities can often torpedo what might otherwise be a secure network. Risks are posed when the devices—which are exposed to the Internet—are deployed with weak security configurations or surreptitiously connected to by insiders. Firmware vulnerabilities also leave them open to remote takeover. No exotic zero-days here On Tuesday, researchers from security firm Eclypsium disclosed a total of nine vulnerabilities in IP KVMs from four manufacturers. The most severe flaws allow unauthenticated hackers to gain root access or run malicious code on them. “These are not exotic zero-days requiring months of reverse engineering,” Eclypsium researchers Paul Asadoorian and Reynaldo Vasquez Garcia wrote. “These are fundamental security controls that any networked device should implement. Input validation. Authentication. Cryptographic verification. Rate limiting. We are looking at the same class of failures that plagued early IoT devices a decade ago, but now on a device class that provides the equivalent of physical access to everything it connects to.” Vendor Product CVE Vulnerability CVSS 3.1 Patch Status GL-iNet Comet RM-1 CVE-2026-32290 GL-iNet Comet KVM insufficient verification of firmware authenticity 4.2 Fix being planned. GL-iNet Comet RM-1 CVE-2026-32291 GL-INet Comet KVM UART root access 7.6 Fix being planned. GL-iNet Comet RM-1 CVE-2026-32292 GL-INet Comet KVM insufficient brute-force protection 5.3 Fixed in v1.8.1 BETA GL-iNet Comet RM-1 CVE-2026-32293 GL-iNet Comet KVM Insecure Initial Provisioning via Unauthenticated Cloud Connection 3.1 Fixed in v1.8.1 BETA Angeet/Yeeso ES3 KVM CVE-2026-32297 Angeet ES3 KVM unauthenticated file 9.8 No fix available Angeet/Yeeso ES3 KVM CVE-2026-32298 Angeet ES3 KVM OS command injection 8.8 No fix available Sipeed NanoKVM CVE-2026-32296 Sipeed NanoKVM configuration endpoint exposure 5.4 Fixed in NanoKVM v2.3.1 and NanoKVM Pro 1.2.4 JetKVM JetKVM CVE-2026-32294 JetKVM insufficient update verification 6.7 Fixed in version 0.5.4 JetKVM JetKVM CVE-2026-32295 JetKVM insufficient rate limiting 7.3 Fixed in version 0.5.4 As the table above shows, some of the devices are being fixed. As of Tuesday, however, the most severe vulnerabilities—found in IP KVMs made by Angeet/Yeeso—aren’t. Device vulnerabilities are only one type of risk posed by such devices. Threats are also posed because it’s easy to intentionally or unintentionally deploy them in ways that leave an entire network vulnerable. HD Moore, a security expert and the founder and CEO of runZero, performed an Internet scan on Monday that found a little more than 1,300 such devices, up from about 1,000 he found last June . Moore has long warned about the risks posed by baseboard management controllers (BMCs), the motherboard-attached microcontrollers that allow admins to remotely access entire fleets of servers. He said IP KVMs can similarly expose networks. “The core issue is that if the KVM is compromised, it’s often easy to take over whatever system the KVM is attached to, even if that system is otherwise secure from network attacks,” Moore said in an interview. “Similar to BMCs, any flaw on the out-of-band side undercuts the existing security measures. The specific bugs vary, but the end result is access to a server that someone thinks is important enough to warrant remote management.” Both runZero and Eclypsium recommend admins scan their networks to identify any overlooked IP KVMs. Asadoorian has made scanning tools available here . Both say that the devices should be secured with a strong password and the use of a reputable VPN. Both Wireguard and Tailscale provide easy integration. Dan Goodin Senior Security Editor Dan Goodin Senior Security Editor Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. In his spare time, he enjoys gardening, cooking, and following the independent music scene. Dan is based in San Francisco. Follow him at here on Mastodon and here on Bluesky. Contact him on Signal at DanArs.82. 18 Comments Comments Forum view Loading comments... Prev story Next story 1. Gamers react with overwhelming disgust to DLSS 5's generative AI glow-ups 2. A large meteor is visible from much of Ohio and parts of neighboring states 3. Elon Musk's xAI sued for turning three girls' real photos into AI CSAM 4. Paul Atreides faces the cost of his holy war in Dune: Part 3 teaser 5. After three months, Samsung is ending sales of the $2,899 Galaxy Z TriFold Customize