PT-2026-25918 · Sipeed · Nanokvm

Published 2026-03-17 · Updated 2026-03-17 · CVE-2026-32296

NVD

CVSS v3.1

8.2

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Sipeed NanoKVM before 2.3.1 exposes a Wi-Fi configuration endpoint without proper security checks, allowing an unauthenticated attacker with network access to change the saved configured Wi-Fi network to one of the attacker's choosing, or craft a request to exhaust the system memory and terminate the KVM process.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-32296

Affected Products

Nanokvm

References · 5

• https://github.com/sipeed/NanoKVM/blob/main/CHANGELOG.md#231-2025-12-26 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-32296 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-32296 · Security Note
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-076-01.json · Note
• https://eclypsium.com/blog/kvm-devices-the-keys-to-your-kingdom-are-hanging-on-the-network · Note