Description
JetKVM prior to 0.5.4 does not verify the authenticity of downloaded firmware files. An attacker-in-the-middle or a compromised update server could modify the firmware and the corresponding SHA256 hash to pass verification.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| JetKVM | JetKVM | < 0.5.4 | 0.5.4 |
Advisories 1
- VA-26-076-01 Multiple IP-KVM Vulnerabilities CISA ICS & IT advisories · Mar 24, 2026