Loading story…
Researchers disclosed multiple vulnerabilities affecting internet-connected IP KVM devices from GL-iNet, JetKVM, Sipeed, and Angeet/Yeeso, warning that compromise of these products can give attackers effective BIOS- and UEFI-level keyboard, video, and mouse access to connected systems. Reported flaws include OS command injection, unauthenticated file access, weak firmware authenticity verification, exposed configuration endpoints, insecure provisioning, and insufficient brute-force or rate-limiting protections. The most severe issues were reported in Angeet/Yeeso ES3 KVM devices, including CVE-2026-32297 and CVE-2026-32298, with no fixes available at publication, while other vendors had released patches or beta updates for some affected products.
The disclosures highlight a broader risk from the rapid spread of inexpensive remote-management hardware that operates below the operating system and outside the visibility of many endpoint defenses. Security researchers and industry experts warned that a compromised IP KVM can provide attackers with the equivalent of physical access to attached machines, enabling keystroke injection, BIOS manipulation, safe-mode booting, and persistent reinfection. Internet scanning cited in coverage found more than 1,300 exposed devices, underscoring that the issue is not limited to product flaws alone but also to unsafe deployment of these management interfaces on reachable networks.
See affected versions and whether adversaries are exploiting it.
7 events from the most recent confirmed update back to the earliest known activity.
A March 23, 2026 reference said more than 1,600 IP KVM devices were directly exposed to the internet, indicating continued growth from the more than 1,300 systems previously reported. The higher count reinforced concerns that vulnerable low-cost KVMs remained broadly reachable online.
Following disclosure, Eclypsium and runZero recommended that administrators scan for overlooked IP KVMs, restrict internet exposure, isolate them on separate networks where possible, use strong passwords, and access them through reputable VPNs such as WireGuard or Tailscale.
By March 2026, runZero founder HD Moore reported finding more than 1,300 internet-exposed IP KVM devices, up from about 1,000 the previous June. The increase reinforced concerns that vulnerable KVMs were both discoverable and growing in number online.
At the time of disclosure, Angeet/Yeeso had not committed fixes for its two most severe vulnerabilities, while Sipeed and JetKVM had released fixes or beta fixes for some issues and GL-iNet had planned or beta remediations for others. This established that patch availability varied significantly across affected vendors.
On publication of its March 2026 report, Eclypsium warned that low-cost internet-connected IP KVMs can provide attackers BIOS/UEFI-level control over attached systems. The disclosure highlighted severe Angeet/Yeeso ES3 flaws, including unauthenticated file upload and root command injection vulnerabilities.
Eclypsium researchers Reynaldo Vasquez Garcia and Paul Asadoorian analyzed IP KVM products from GL-iNet, Angeet/Yeeso, Sipeed, and JetKVM and found nine vulnerabilities. The issues included missing firmware signature validation, weak access controls, exposed debug interfaces, and lack of brute-force protection.
runZero had identified roughly 1,000 IP KVM devices exposed to the internet by June 2025, establishing an early warning sign that these systems were broadly reachable online.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
10 references tracked. Mallory keeps watching after this page renders.
eclypsium.com
Open sourcecybersecuritynews.com
Open sourcescworld.com
Open sourcecsoonline.com
Open sourceeclypsium.com
Open sourceeclypsium.com
Open sourcebankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco disclosed **CVE-2026-20200**, a high-severity argument injection flaw in the web-based management interface of Cisco Integrated Management Controller (**IMC**) that allows an authenticated low-privilege attacker to execute arbitrary commands as `root`. The vulnerability, scored **CVSS 8.8**, affects multiple Cisco Unified Computing System standalone releases in the 4.3 and 6.0 branches, and Cisco urged customers to apply updates, validate management-interface inputs, and limit privileges for authenticated users. At the same time, research presented by runZero and reported from Black Hat 2026 warned that baseboard management controllers (**BMCs**) across major vendors remain broadly exposed and vulnerable to takeover. runZero said it found multiple flaws affecting platforms including **OpenBMC, Supermicro IPMI, HPE iLO, Dell iDRAC, AMI MegaRAC, Raritan, H3C HDM, and Fujitsu BMC**, while scans cited by Ars Technica identified more than **86,000** Internet-exposed BMCs and found over **54%** with at least one critical weakness. Researchers said exploitation can enable persistent server backdoors, lateral movement, and segmentation bypass, and recommended isolating BMC interfaces from the public Internet, monitoring vendor advisories, patching promptly, and disabling legacy management features such as IPMI and KCS where possible.
Aug 6, 2026
CISA published ICS advisories warning of **critical “missing authentication for critical function”** weaknesses (CWE-306) that expose device management/control interfaces to unauthenticated access. **Synectix LAN 232 TRIO** (3-port serial-to-Ethernet adapter) is affected in **all versions** under **CVE-2026-1633** with **CVSS 3.1 10.0**, enabling unauthenticated attackers to **modify critical device settings** or **factory reset** the device. **Avation Light Engine Pro** is also affected in **all versions** under **CVE-2026-1341** with **CVSS 3.1 9.8**, allowing an attacker to **take full control** of the device due to an exposed configuration/control interface without authentication. Separate reporting highlighted a similar CISA alert for **KiloView Encoder Series** devices, tracked as **CVE-2026-1453** with **CVSS 9.8**, where missing authentication allows unauthenticated users to perform administrative actions such as **creating or deleting administrator accounts**, potentially granting full administrative control and enabling disruption or hijacking of broadcast/streaming workflows. The KiloView issue was described as affecting multiple Encoder Series models and specific firmware/hardware combinations (e.g., E1/E1-s/E2 with listed firmware versions), reinforcing the broader risk of internet- or enterprise-exposed device management planes lacking access control.
Jun 29, 2026
Public disclosures highlighted multiple high-severity vulnerabilities across industrial control systems, open-source software, and consumer networking gear, with several issues enabling **unauthenticated remote compromise**. Johnson Controls disclosed **CVE-2025-26385** (CVSS 10.0), a critical SQL injection affecting multiple building/ICS management products (including *ADS/ADX, LCS8500, NAE8500, SCT, CCT*) that can allow remote, unauthenticated attackers to execute arbitrary SQL to alter/delete/exfiltrate data; CISA guidance emphasized isolating control system networks from the internet, segmentation, and controlled remote access (e.g., VPNs). Additional unauthenticated remote issues include **CVE-2026-25069** in *SunFounder Pironman Dashboard* (path traversal in log API endpoints enabling arbitrary file read/deletion) and **CVE-2025-51958** in the *DokuWiki* `runcommand` plugin (unauthenticated command execution via `lib/plugins/runcommand/postaction.php`). Other disclosures include developer-tooling and application-layer injection flaws and multiple router memory-corruption bugs with public exploit references. *Orval* fixed **CVE-2026-25141**, a code-injection issue where incomplete escaping can be bypassed using **JSFuck**-style payloads, and *Cybersecurity AI (CAI)* addressed **CVE-2026-25130**, where `subprocess.Popen(..., shell=True)` enables argument/command injection leading to RCE (notably via the `find_file()` tool). Data-layer issues include **CVE-2025-69662** in *geopandas* (`to_postgis()` SQL injection) and **CVE-2026-24854** in *ChurchCRM* (authenticated SQL injection via `PerID` in `/PaddleNumEditor.php`, patched in 6.7.2), while **CVE-2025-36384** affects *IBM Db2 for Windows* (local privilege escalation via unquoted search path). SOHO router flaws **CVE-2026-1686** (*Totolink A3600R*) and **CVE-2026-1637** (*Tenda AC21*) describe remotely reachable buffer/stack overflows with publicly available exploit material, increasing the likelihood of opportunistic exploitation where exposed management interfaces exist.
Jun 29, 2026