Researchers disclose vulnerabilities in IP KVMs from four manufacturers

Security researchers from Eclypsium disclosed nine vulnerabilities in IP KVM devices from four manufacturers, with the most severe allowing unauthenticated root access or remote code execution. These low-cost ($30–$100) devices give remote BIOS/UEFI-level access to networked machines, making them high-value targets when exposed to the internet with weak configurations or unpatched firmware. The researchers noted the flaws stem from basic security failures—missing input validation, authentication, and cryptographic verification—mirroring issues that plagued early IoT devices.