9 Critical IP KVM Flaws Enable Unauthenticated Root Access Across Four Vendors

Eclypsium researchers disclosed nine vulnerabilities across four low-cost IP KVM devices that can grant unauthenticated root access and arbitrary code execution.

• •CVE-2026-32297 (CVSS 9.8) affects Angeet ES3 KVM, allowing arbitrary code execution with no fix available; CVE-2026-32298 (CVSS 8.8) enables OS command injection on the same device.
• •Common failure patterns include missing firmware signature validation, no brute-force protection, broken access controls, and exposed debug interfaces.
• •Exploitation can allow keystroke injection, bypassing Secure Boot/disk encryption, circumventing lock screens, and persisting undetected below the OS level.
• •Mitigations include enforcing MFA, isolating KVM devices on a dedicated management VLAN, restricting internet access, and keeping firmware updated.