Critical Vulnerabilities in IP KVM Devices Expose Network Risks

Cybersecurity researchers have identified nine critical vulnerabilities in low-cost IP KVM devices, including Sipeed NanoKVM, which could allow unauthenticated attackers to gain extensive control over compromised hosts. The vulnerabilities, discovered by Eclypsium, enable attackers to execute arbitrary code, bypass security measures, and gain root access. One notable vulnerability, CVE-2026-32296, allows attackers to modify Wi-Fi configurations without authentication, posing a significant threat to network security. Another severe flaw, CVE-2026-32297, has a CVSS score of 9.8 and allows arbitrary code execution, with no fix currently available. The lack of proper security controls in these devices has been a long-standing issue, raising concerns about their deployment in sensitive environments. Recommended mitigations include isolating KVM devices on separate VLANs and enforcing multi-factor authentication. Current status shows no public proof-of-concept or evidence of exploitation for CVE-2026-32296, but the overall risk remains high. Organizations are urged to patch affected devices and monitor network traffic for suspicious activity.

Key Points: • Nine critical vulnerabilities identified in low-cost IP KVM devices. • CVE-2026-32296 allows unauthenticated access to modify Wi-Fi settings. • CVE-2026-32297 has a CVSS score of 9.8, enabling arbitrary code execution.