CVE-2026-32294CWE-345CWE-347
JetKVM insufficient firmware verification
High · published March 17, 2026
What it is
JetKVM prior to 0.5.4 does not verify the authenticity of downloaded firmware files. An attacker-in-the-middle or a compromised update server could modify the firmware and the corresponding SHA256 hash to pass verification.
The record
Technical detail
- CVSS v4.0
- 7.0 · HIGH
- Vector
- CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H
- EPSS
- 0.00103 · 0.9th percentile
- Weaknesses
- CWE-345 · Insufficient Verification of Data Authenticity; CWE-347 · Improper Verification of Cryptographic Signature
- Published
- 2026-03-17T17:19Z
EPSS history
Timeline