Jetkvm CVE-2026-32295

JetKVM versions before 0.5.4 with default configuration lacking login rate limiting. Network-accessible login interface required with no authentication bypass prerequisite.

The CVSS score of 7.5 (High) reflects a network-exploitable vulnerability with low attack complexity requiring no privileges or user interaction (AV:N/AC:L/PR:N/UI:N), though impact is limited to confidentiality (C:H/I:N/A:N). The attack vector allows remote exploitation over the network, and the low complexity means exploitation is straightforward once the device is network-accessible. Given that KVM devices are explicitly called out by Eclypsium as 'keys to your kingdom' hanging on the network, the real-world risk is substantial for organizations using these devices in production environments. The vulnerability enables credential compromise which can lead to complete infrastructure control beyond the initial confidentiality impact suggested by CVSS. CISA-CG involvement indicates government concern about this vulnerability class. With a patch available since version 0.5.4, organizations running older versions face immediate risk from automated scanning and credential stuffing attacks. The vulnerability is highly automatable, making it attractive for opportunistic attackers scanning for exposed KVM devices.

An attacker discovers a JetKVM device exposed on the internet through network scanning tools like Shodan or direct reconnaissance. Using automated brute-force tools such as Hydra or custom scripts, the attacker launches a dictionary attack against the login interface, systematically trying common usernames and passwords without being throttled or blocked. After successfully guessing valid credentials (especially if default or weak passwords are in use), the attacker gains full KVM access to connected servers, allowing them to view screen output, control keyboard and mouse input, access BIOS settings, mount virtual media, and potentially deploy ransomware or establish persistent backdoors at the firmware level.