Paper/Archive/CVE-2026-32298

CVE-2026-32298

ANGEET ES3 KVM — Angeet ES3 KVM OS command injection

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 51.5.515 × 2010.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The Angeet ES3 KVM does not properly sanitize user-supplied variables parsed by the 'cfg.lua' script, allowing an authenticated attacker to execute OS-level commands.

Affected

ProductAffectedFixed inSource

ES3 KVMall versions–CNA

Scores by source

cisa-cg (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

cisa-cg (CNA)8.5CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refeclypsium.com/blog/kvm-devices-the-keys-to-your-kingdom-are-hanging-on-the-network refraw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-076-01.json refcve.org/CVERecord?id=CVE-2026-32291