Description
JetKVM prior to 0.5.4 does not verify the authenticity of downloaded firmware files. An attacker-in-the-middle or a compromised update server could modify the firmware and the corresponding SHA256 hash to pass verification.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
JetKVM JetKVM
Default version status: unknown
0 to < 0.5.4affected0.5.4unaffected
References
- https://github.com/jetkvm/kvm/releases/tag/release%2F0.5.4 ↗
- https://eclypsium.com/blog/kvm-devices-the-keys-to-your-kingdom-are-hanging-on-the-network/ ↗
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-076-01.json ↗
- https://www.cve.org/CVERecord?id=CVE-2026-32294 ↗