Security researchers have disclosed nine vulnerabilities affecting low-cost IP KVM devices from four vendors, warning that the most severe flaws could allow unauthenticated attackers to gain root access or run arbitrary code. According to The Hacker News, the issues were discovered by Eclypsium across products from GL-iNet, Angeet or Yeeso, Sipeed and JetKVM.
IP KVM devices provide remote control over a target system’s keyboard, video output and mouse input, often at the BIOS or UEFI layer. That level of access makes them especially sensitive: if a device is compromised, an attacker may be able to bypass disk encryption workflows, interact with the boot process, evade operating system protections and maintain a persistent control channel outside the normal visibility of host-based security tools.
Eclypsium says the weaknesses include missing firmware signature verification, weak or absent brute-force protections, broken access controls and exposed debug interfaces. The most serious issues include CVE-2026-32297, rated 9.8, a missing-authentication flaw in Angeet ES3 KVM that can lead to arbitrary code execution, and CVE-2026-32298, rated 8.8, an operating system command injection bug in the same product. The disclosures also include multiple flaws in GL-iNet Comet KVM, JetKVM and Sipeed NanoKVM, with some fixes already available and others still pending.
The report argues that these are not highly complex edge-case vulnerabilities but rather basic security failures in a class of hardware that effectively grants physical-style access over the network. That combination makes the risk unusually serious for enterprises, labs and remote management environments that rely on KVM-over-IP devices for troubleshooting, administration or out-of-band access.
As mitigations, researchers recommend isolating KVM devices on dedicated management networks, restricting internet exposure, enabling multi-factor authentication where supported, monitoring unusual network traffic and keeping firmware up to date. The broader warning is that a compromised KVM can serve as a covert bridge back into every machine it manages, even after host remediation.