CVE-2026-32298 - Vulnerability Analysis
CriticalCVSS: 9.1Last Updated: March 18, 2026
Angeet ES3 KVM - Command Injection
Overview
Angeet ES3 KVM contains a command injection caused by improper sanitization of user-supplied variables in cfg.lua script, letting authenticated attackers execute OS-level commands.
Severity & Score
Impact
Authenticated attackers can execute arbitrary OS-level commands, potentially compromising the entire system.
Mitigation
Update to the latest version with proper input sanitization.
References
Social Media Activity(3 posts)
š“ CVE-2026-32298 - Critical (9.1) The Angeet ES3 KVM does not properly sanitize user-supplied variables parsed by the 'cfg.lua' script, allowing an authenticated attacker to execute OS-level commands. š https://www.thehackerwire.com/vulnerability/CVE-2026-32298/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original postš“ CVE-2026-32298 - Critical (9.1) The Angeet ES3 KVM does not properly sanitize user-supplied variables parsed by the 'cfg.lua' script, allowing an authenticated attacker to execute OS-level commands. š https://www.thehackerwire.com/vulnerability/CVE-2026-32298/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original postš“ CVE-2026-32298 - Critical (9.1) The Angeet ES3 KVM does not properly sanitize user-supplied variables parsed by the 'cfg.lua' script, allowing an authenticated attacker to execute OS-level commands. š https://www.thehackerwire.com/vulnerability/CVE-2026-32298/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original postRelated Resources
Details
- CVE ID
- CVE-2026-32298
- Severity
- Critical
- CVSS Score
- 9.1
- Type
- command_injection
- Status
- unconfirmed
- EPSS
- 4.1%
- Social Posts
- 3
CWE
- CWE-78
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H