EUVD-2026-12610Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request to Wi-Fi endpoint
-
ExploitModify Wi-Fi network configuration
-
ExecutionExhaust system memory
-
ImpactTerminate KVM process
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Sipeed NanoKVM before version 2.3.1 with Wi-Fi configuration endpoint exposed on network. No authentication required; default configuration vulnerable to remote unauthenticated exploitation. |
| Impact | The CVSS 3.1 score of 8.2 reflects high real-world risk with network-based attack vector (AV:N), low complexity (AC:L), and no privileges required (PR:N), enabling both integrity and availability impacts. The vulnerability allows unauthenticated remote exploitation, making it highly automatable and accessible to unsophisticated attackers. While EPSS and KEV data are not available, the combination of authentication bypass on a device managing critical infrastructure access, coupled with the straightforward exploitation path, makes this a priority for organizations using affected NanoKVM devices. The technical impact is significant as compromised KVM devices can provide attackers with console-level access to managed systems. |
| Exploit ScenarioDerived | An attacker on the same network as the NanoKVM device sends unauthenticated requests to the exposed Wi-Fi configuration endpoint, changing the device's wireless settings to connect to an attacker-controlled access point. Once connected to the malicious network, the attacker can intercept all KVM traffic, potentially capturing credentials and console access to managed servers. Alternatively, the attacker can craft malicious requests to exhaust system memory, causing the KVM process to crash and denying legitimate administrators remote access to critical systems. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
A critical authentication bypass vulnerability in Sipeed NanoKVM KVM-over-IP devices allows unauthenticated remote attackers to hijack Wi-Fi configurations or crash the device through memory exhaustion. The vulnerability affects NanoKVM versions before 2.3.1 and enables attackers with network access to redirect the device to attacker-controlled networks or cause denial of service. While not currently in CISA KEV, the issue has been analyzed by security researchers and a patch is available from the vendor.
RemediationAI
Upgrade Sipeed NanoKVM firmware to version 2.3.1 or later immediately, as documented in the vendor's changelog at https://github.com/sipeed/NanoKVM/blob/main/CHANGELOG.md#231-2025-12-26. Until patching is complete, isolate NanoKVM devices on dedicated management VLANs with strict firewall rules limiting access to authorized administrators only. Consider implementing network segmentation to prevent unauthorized access to the vulnerable Wi-Fi configuration endpoint and monitor for unexpected configuration changes or memory exhaustion indicators.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects Sipeed NanoKVM devices (CPE: cpe:2.3:a:sipeed:nanokvm:*:*:*:*:*:*:*:*), which are KVM-over-IP solutions that provide remote access to servers and computers. The root cause is CWE-306 (Missing Authentication for Critical Function), where the Wi-Fi configuration endpoint lacks proper authentication checks before processing configuration changes. NanoKVM devices are particularly sensitive as they provide remote access to critical infrastructure, making Wi-Fi hijacking especially dangerous since it could redirect KVM traffic through attacker-controlled networks.
Know when Nanokvm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Sipeed NanoKVM before 2.3.1 exposes a Wi-Fi configuration endpoint without proper security checks, allowing an unauthenticated attacker with network access to change the saved configured Wi-Fi network to one of the attacker's choosing, or craft a request to exhaust the system memory and terminate the KVM process.
Executive ViewAI
Sipeed NanoKVM devices in your infrastructure face an authentication bypass vulnerability (CVE-2026-32296, CVSS 8.2) that allows unauthenticated attackers to hijack Wi-Fi configurations or crash devices remotely. Any organization running affected NanoKVM versions before 2.3.1 is at immediate risk of network compromise and operational disruption, particularly if these devices manage critical infrastructure or remote access.
Apply vendor patch. If immediate patching is not feasible, implement network segmentation by restricting NanoKVM devices to isolated VLANs with access controls, disable remote management features until patched, monitor device logs for suspicious authentication attempts, and enforce VPN-only access to device management interfaces.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB