CVE-2026-32298 Angeet ES3 KVM OS command injection
An authenticated attacker can execute OS-level commands on the Angeet ES3 KVM due to improper input sanitization in the cfg.lua script.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-32298?
CVE-2026-32298 is a high-severity command injection vulnerability in ANGEET ES3 KVM, published on 17 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Angeet ES3 KVM does not properly sanitize user-supplied variables parsed by the 'cfg.lua' script, allowing an authenticated attacker to execute OS-level commands.
Weakness: CWE-78
Which versions are affected by CVE-2026-32298?
It affects 1 product.
Products include Angeet Es3 Kvm Firmware.
How do I fix CVE-2026-32298?
No fix has been published for CVE-2026-32298 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-32298 being exploited?
There is no known exploitation of CVE-2026-32298 in the wild and no public exploit code.
Other vulnerabilities in ANGEET ES3 KVM
Sources
Also known as GHSA-j2r8-jvcw-qvwr.