CVE-2026-32298
Published: 17 March 2026
Summary
CVE-2026-32298 is a high-severity OS Command Injection (CWE-78) vulnerability in Angeet Es3 Kvm Firmware. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-32298 is an OS command injection vulnerability (CWE-78) in the Angeet ES3 KVM device, stemming from improper sanitization of user-supplied variables parsed by the 'cfg.lua' script. Published on 2026-03-17, it carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), highlighting its critical potential impact due to network accessibility, low attack complexity, and severe consequences across confidentiality, integrity, and availability.
An authenticated attacker with high privileges can exploit this flaw over the network without user interaction. By injecting malicious content into unsanitized variables processed by the cfg.lua script, the attacker achieves arbitrary OS-level command execution on the device, enabling full compromise including data exfiltration, modification, or disruption, with scope expansion to the underlying system.
Advisories referenced in Eclypsium's blog on KVM devices, CISA's CSAF document (VA-26-076-01), and related CVE records provide additional context, though specific patch or mitigation guidance is not detailed in the core CVE description.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12614
Vulnerability details
The Angeet ES3 KVM does not properly sanitize user-supplied variables parsed by the 'cfg.lua' script, allowing an authenticated attacker to execute OS-level commands.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection (CWE-78) in network-accessible management interface (cfg.lua) directly enables T1190 for initial compromise of the public-facing KVM device, T1059.004 for arbitrary Unix shell command execution, and T1068 for privilege escalation from application context to full OS/system compromise (scope change).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of user-supplied variables processed by cfg.lua to prevent OS command injection.
Mandates identification, prioritization, and remediation of flaws like the improper input sanitization in cfg.lua, preventing exploitation via patching.
Enforces least privilege on high-privilege accounts and processes handling cfg.lua inputs, limiting the scope and impact of injected OS commands.