<p>Security researchers at Eclypsium have disclosed nine vulnerabilities across IP KVM devices from four manufacturers: GL-iNet, Angeet/Yeeso, Sipeed, and JetKVM. These are the $30–$100 devices that give you BIOS/UEFI-level remote access to machines — useful for managing servers without being physically present, but also a significant risk if compromised.</p>
<h2>What was found</h2>
<p>The vulnerabilities include unauthenticated command injection, insecure firmware update mechanisms, missing brute-force protections, and in some cases unauthenticated root access. The root causes are familiar: missing input validation, weak authentication, and no cryptographic verification of firmware. These are the same basic failures that defined the first wave of insecure IoT devices a decade ago — except here the hardware has physical-level access to every machine plugged into it.</p>
<p>That last part matters. A compromised IP KVM sits below your EDR tools and host firewalls. It can interact with systems at the BIOS level, before the operating system even loads.</p>
<h2>Exposure</h2>
<p>More than 1,600 of these devices are currently exposed to the internet, according to Eclypsium’s research. Some vendors have issued patches; others haven’t.</p>
<h2>What to do</h2>
<p>If you’re running any of these devices, the practical steps are straightforward:</p>
<ul>
<li>Put KVM devices on a dedicated management VLAN, isolated from your main network</li>
<li>Don’t expose them directly to the internet</li>
<li>Enable two-factor authentication where available</li>
<li>Check whether your vendor has issued a patch and apply it</li>
<li>Audit your network for any KVM deployments you didn’t know about</li>
</ul>
<p>The broader issue is that low-cost remote access hardware keeps shipping with security basics missing. The price point makes these devices attractive for home labs and small businesses, but the access they provide makes vulnerabilities in them disproportionately dangerous.</p>


Collections

Security researchers at Eclypsium have disclosed nine vulnerabilities in low-cost IP KVM devices from GL-iNet, Angeet/Yeeso, Sipeed, and JetKVM. The flaws include unauthenticated command injection, insecure firmware update mechanisms, missing brute-force protections, and unauthenticated root access — rooted in missing input validation, weak authentication, and no cryptographic firmware verification. Over 1,600 of these devices are currently internet-exposed. Because IP KVMs operate below the OS at the BIOS/UEFI level, a compromise bypasses EDR tools and host firewalls entirely. Recommended mitigations include isolating devices on a dedicated management VLAN, avoiding direct internet exposure, enabling 2FA, applying available patches, and auditing for unknown KVM deployments.

Nine vulnerabilities found in low-cost IP KVM devices from four manufacturers