CVE-2026-32294
JetKVM prior to 0.5.4 does not verify the authenticity of downloaded firmware files.
Published Mar 17, 2026 · updated Jun 17, 2026 · jetkvm kvm
JetKVM prior to 0.5.4 does not verify the authenticity of downloaded firmware files. An attacker-in-the-middle or a compromised update server could modify the firmware and the corresponding SHA256 hash to pass verification.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 17, 2026 · NIST NVD
Detected
JetKVM prior to 0.5.4 does not verify the authenticity of downloaded firmware files. An attacker-in-the-middle or a compromised update server could modify the firmware and the corresponding SHA256 hash to pass verification.
Jun 17, 2026 · NIST NVD
Updated
JetKVM prior to 0.5.4 does not verify the authenticity of downloaded firmware files. An attacker-in-the-middle or a compromised update server could modify the firmware and the corresponding SHA256 hash to pass verification.
Affected
- cpe jetkvm/kvmversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-32294
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-32294
JetKVM prior to 0.5.4 does not verify the authenticity of downloaded firmware files. An attacker-in-the-middle or a compromised update server could modify the firmware and the corresponding SHA256 hash to pass verification.
nvd.nist.gov