Description
Sipeed NanoKVM before 2.3.1 exposes a Wi-Fi configuration endpoint without proper security checks, allowing an unauthenticated attacker with network access to change the saved configured Wi-Fi network to one of the attacker's choosing, or craft a request to exhaust the system memory and terminate the KVM process.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Sipeed NanoKVM
Default version status: unknown
0 to < 2.3.1affected2.3.1unaffected
References
- https://github.com/sipeed/NanoKVM/blob/main/CHANGELOG.md#231-2025-12-26 ↗
- https://eclypsium.com/blog/kvm-devices-the-keys-to-your-kingdom-are-hanging-on-the-network/ ↗
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-076-01.json ↗
- https://www.cve.org/CVERecord?id=CVE-2026-32296 ↗