CVE-2026-32298

CriticalRCE

Published: 17 March 2026

Published

17 March 2026

Modified

27 April 2026

KEV Added

—

Patch

—

CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS Score 0.0006 18.4th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-32298 is a critical-severity OS Command Injection (CWE-78) vulnerability in Angeet Es3 Kvm Firmware. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly requires validation and sanitization of user-supplied variables processed by cfg.lua to prevent OS command injection.

SI-2 Flaw Remediation good match

prevent

Mandates identification, prioritization, and remediation of flaws like the improper input sanitization in cfg.lua, preventing exploitation via patching.

AC-6 Least Privilege partial match

prevent

Enforces least privilege on high-privilege accounts and processes handling cfg.lua inputs, limiting the scope and impact of injected OS commands.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.004 Unix Shell Execution

Adversaries may abuse Unix shell commands and scripts for execution.

attack.mitre.org →

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

OS command injection (CWE-78) in network-accessible management interface (cfg.lua) directly enables T1190 for initial compromise of the public-facing KVM device, T1059.004 for arbitrary Unix shell command execution, and T1068 for privilege escalation from application context to full OS/system compromise (scope change).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

The Angeet ES3 KVM does not properly sanitize user-supplied variables parsed by the 'cfg.lua' script, allowing an authenticated attacker to execute OS-level commands.

Deeper analysisAI

CVE-2026-32298 is an OS command injection vulnerability (CWE-78) in the Angeet ES3 KVM device, stemming from improper sanitization of user-supplied variables parsed by the 'cfg.lua' script. Published on 2026-03-17, it carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), highlighting its critical potential impact due to network accessibility, low attack complexity, and severe consequences across confidentiality, integrity, and availability.

An authenticated attacker with high privileges can exploit this flaw over the network without user interaction. By injecting malicious content into unsanitized variables processed by the cfg.lua script, the attacker achieves arbitrary OS-level command execution on the device, enabling full compromise including data exfiltration, modification, or disruption, with scope expansion to the underlying system.

Advisories referenced in Eclypsium's blog on KVM devices, CISA's CSAF document (VA-26-076-01), and related CVE records provide additional context, though specific patch or mitigation guidance is not detailed in the core CVE description.