CVE-2026-32296 - Vulnerability Analysis

Overview

Sipeed NanoKVM < 2.3.1 contains an insecure Wi-Fi configuration endpoint caused by lack of proper security checks, letting unauthenticated attackers with network access change Wi-Fi settings or cause denial of service, exploit requires network access.

Severity & Score

Impact

Unauthenticated attackers can change Wi-Fi settings or cause denial of service by exhausting system memory.

Mitigation

Update to version 2.3.1 or later.

References

• https://eclypsium.com/blog/kvm-devices-the-keys-to-your-kingdom-are-hanging-on-the-network/
• https://github.com/sipeed/NanoKVM/blob/main/CHANGELOG.md#231-2025-12-26
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-076-01.json
• https://www.cve.org/CVERecord?id=CVE-2026-32296

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner