Tuesday, August 11, 2026
LIVEThe Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///The Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///
Subscribe
Cyber Security
Independent · Digital
Thehackingpost
RSSSubscribe
CybersecurityAI-assisted

$30 IP-KVM Flaws Could Enable BIOS-Level Enterprise Network Attacks

Recent research has identified significant security vulnerabilities in low-cost IP-KVM devices. Nine vulnerabilities have been discovered across devices from four vendors, which could potentially allow these budget management tools to be exploited as…

OBy Olivia HarperMar 24, 20261 min read

Recent research has identified significant security vulnerabilities in low-cost IP-KVM devices. Nine vulnerabilities have been discovered across devices from four vendors, which could potentially allow these budget management tools to be exploited as attack platforms.

The vulnerabilities in question affect devices from GL-iNet, Angeet, Sipeed, and JetKVM. These devices, priced between $30 and $100, have become prevalent in enterprise data centers, healthcare facilities, and industrial environments. Despite their affordability, these devices come with considerable security risks.

Security experts have noted that a compromised KVM device can provide attackers with physical-level control over all connected machines, allowing them to bypass operating systems and endpoint security measures.

GL-iNet Comet RM-1: Issues include weak firmware verification, UART root access, insufficient brute-force protection, and insecure initial cloud provisioning. Angeet ES3 KVM: Critical flaws include an unauthenticated file upload vulnerability and an OS command injection bug. Sipeed NanoKVM: Exposed configuration endpoint vulnerability. JetKVM: Issues with insufficient update verification and rate limiting.

Vendor Product CVE Vulnerability CVSS Status

GL-iNet Comet RM-1 CVE-2026-32290 Insufficient firmware verification 4.2 No fix planned

Recent research has identified significant security vulnerabilities in low-cost IP-KVM devices.
Olivia Harper · Thehackingpost

GL-iNet Comet RM-1 CVE-2026-32291 UART root access 7.6 No fix planned

GL-iNet Comet RM-1 CVE-2026-32292 Insufficient brute-force protection 5.3 Fixed in v1.8.1 BETA

GL-iNet Comet RM-1 CVE-2026-32293 Insecure initial cloud provisioning 3.1 Fixed in v1.8.1 BETA

Angeet ES3 KVM CVE-2026-32297 Unauthenticated file upload 9.8 No fix available

Angeet ES3 KVM CVE-2026-32298 OS command injection 8.8 No fix available

Advertisement

Sipeed NanoKVM CVE-2026-32296 Configuration endpoint exposure 5.4 Fixed in v2.3.1

JetKVM JetKVM CVE-2026-32294 Insufficient update verification 6.7 Fixed in v0.5.4

JetKVM JetKVM CVE-2026-32295 Insufficient rate limiting 7.3 Fixed in v0.5.4

Security measures must be taken to isolate KVM devices on dedicated networks and prevent exposure to the public internet. Given their ability to operate below the operating system, traditional antivirus and firewall software cannot detect these compromised devices.

Based on reporting by GBHackers.

AI transparency. This article was produced with the assistance of artificial intelligence and published under human editorial oversight. AI systems can make mistakes. Read how we use AI (EU AI Act, Art. 50).
Related Stories
Cybersecurity

Why Fintech Banking Platforms Are Reducing Operational Costs by 40%

Paige Monroe · Mar 26, 2026
Cybersecurity

Dogecoin Price Prediction: SHIB Burns 172M Tokens as Pepeto Exchange Earns From Every Trade

Eric Wallace · Mar 26, 2026
Cybersecurity

Solana Price Prediction: SOL Holds $86 With Commodity Status as Pepeto Targets Bigger Returns

Zachary Burns · Mar 26, 2026
Cybersecurity

Open Directory Malware Campaign Uses Obfuscated VBS, PNG Loaders and RAT Payloads

Joseph Cain · Mar 26, 2026