CVE-2026-32298: Angeet ES3 KVM Firmware RCE Vulnerability

CVE-2026-32298 Overview

CVE-2026-32298 is an OS command injection vulnerability in the Angeet ES3 KVM device. The cfg.lua script fails to sanitize user-supplied variables before passing them to the underlying operating system. An authenticated attacker with high privileges can inject and execute arbitrary OS-level commands on the device over the network. Because keyboard-video-mouse (KVM) appliances sit between administrators and managed servers, command execution on the device exposes downstream systems and credentials. The flaw maps to CWE-78, Improper Neutralization of Special Elements used in an OS Command.

Critical Impact
Authenticated attackers can execute arbitrary OS commands on the ES3 KVM, pivoting to managed systems and the broader management network.

Affected Products

Angeet ES3 KVM
Angeet ES3 KVM Firmware (all versions per NVD CPE entry)
Deployments exposing the KVM management interface to untrusted networks

Discovery Timeline

2026-03-17 - CVE-2026-32298 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-32298

Vulnerability Analysis

The Angeet ES3 KVM web management stack uses Lua scripts to handle configuration requests. The cfg.lua script accepts user-supplied parameters and passes them into OS-level command invocations without proper neutralization of shell metacharacters. An authenticated user can append shell operators such as ;, |, or backticks to inject arbitrary commands. The injected commands run with the privileges of the web service process on the embedded firmware, which on management appliances typically runs as a privileged account.

The network attack surface is reachable wherever the KVM management plane is exposed. Research from Eclypsium on KVM device exposure shows that KVM appliances are frequently reachable from broader segments than intended, expanding the practical attack surface.

Root Cause

The root cause is missing input sanitization in cfg.lua. The script concatenates request parameters directly into command strings invoked by Lua functions such as os.execute or io.popen. Without an allow-list or shell-escaping routine, attacker-controlled metacharacters terminate the intended command and start a new one.

Attack Vector

Exploitation requires valid authenticated credentials with high privileges and network access to the management interface. The attacker sends a crafted HTTP request to the configuration endpoint backed by cfg.lua, embedding shell metacharacters in a vulnerable parameter. The firmware executes the injected command, returning output or establishing further access. Successful exploitation yields integrity and availability impact on the device and the systems it manages, consistent with the scope-changing nature recorded in the CVSS vector.

No public proof-of-concept code is available for this CVE. See the CISA CSAF advisory for the coordinated disclosure details.

Detection Methods for CVE-2026-32298

Indicators of Compromise

HTTP requests to the ES3 KVM management interface containing shell metacharacters (;, |, &, `, $() in configuration parameters processed by cfg.lua.
Unexpected child processes spawned by the KVM web service, such as sh, wget, curl, nc, or busybox invocations.
Outbound connections initiated from the KVM management IP to attacker-controlled hosts or non-standard destinations.
New or modified files in firmware-writable paths and unexplained configuration changes on the appliance.

Detection Strategies

Inspect web access logs on the KVM for POST or GET requests targeting configuration endpoints with non-alphanumeric characters in parameter values.
Correlate authentication events with subsequent configuration changes to identify abuse of high-privileged accounts.
Forward syslog from the KVM appliance to a centralized analytics platform and alert on process-execution anomalies.

Monitoring Recommendations

Restrict management interface access to a dedicated administrative VLAN and monitor any traffic originating outside that segment.
Alert on logins to the KVM from new source IPs, off-hours timeframes, or geographies outside expected administrative use.
Track firmware version and configuration hash drift to detect unauthorized modifications resulting from command execution.

How to Mitigate CVE-2026-32298

Immediate Actions Required

Remove the ES3 KVM management interface from any internet-facing or general corporate network exposure.
Rotate all administrative credentials used on the device and audit account inventory for unauthorized additions.
Review web and authentication logs on the appliance for prior exploitation attempts referencing cfg.lua.
Contact Angeet support to confirm patch availability and apply firmware updates as soon as they are released.

Patch Information

No vendor patch URL is published in the NVD record at the time of writing. Monitor the CVE-2026-32298 record and the CISA CSAF advisory for updates from Angeet. Apply the vendor-supplied firmware update immediately once released.

Workarounds

Place the KVM behind a jump host and enforce multi-factor authentication on administrator access.
Apply network access control lists permitting only specific administrator workstations to reach the KVM management ports.
Disable or restrict accounts that do not require configuration privileges, since exploitation requires authenticated high-privileged access.
Capture full packet traces of management sessions during the mitigation window to support forensic review if exploitation is suspected.

bash

# Example iptables restriction limiting KVM management access to a single admin host
iptables -A INPUT -p tcp -s 10.0.10.25 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
iptables -A INPUT -p tcp --dport 80  -j DROP