CVE-2026-32298Disclosure(angeet / es3_kvm)

LOWCVSS 8.5 · HIGH

Signal is active with 6 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Angeet ES3 KVM does not properly sanitize user-supplied variables parsed by the 'cfg.lua' script, allowing an authenticated attacker to execute OS-level commands.

angeet CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://eclypsium.com/blog/kvm-devices-the-keys-to-your-kingdom-are-hanging-on-the-network/

Other references

Weakness type (CWE)

CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

es3_kvm
es3_kvm_firmware

Threat summary

6 mentions across 1 observed day

What's happening

Technical details provided in 6 signals
Disclosure: 6 classified signals
6 total mentions across 1 day

Affected systems

Vendors

angeet

Products

es3_kvmes3_kvm_firmware

1 version affected across 2 products

Deep dive

Activity timeline6 mentions / 1d

Signal classification1 categories

Disclosure

6100.0%

Referenced assets7 URLs

By indicator

Full discourse6 posts

The Hacker Wire@TheHackerWire205d
Disclosure
🔴 CVE-2026-32298 - Critical The Angeet ES3 KVM does not properly sanitize user-supplied variables parsed by the 'cfg.lua' script, allowing an authenticated attacker to execute OS-level commands. https://www.thehackerwire.com/vulnerability/CVE-2026-32298/ https://t.co/RxueFEGJK6
Post summary
The tweet announces CVE‑2026‑32298, a critical flaw in Angeet ES3 KVM that lets authenticated users run arbitrary OS commands due to unsanitized variables in cfg.lua.
0001052
137 followersView on X
CVE@CVEnew205d
Disclosure
CVE-2026-32298 The Angeet ES3 KVM does not properly sanitize user-supplied variables parsed by the 'cfg.lua' script, allowing an authenticated attacker to execute OS-level commands. https://www.cve.org/CVERecord?id=CVE-2026-32298
Post summary
The post gives a concise vulnerability description for CVE-2026-32298, highlighting a flaw in Angeet ES3 KVM’s cfg.lua script that allows authenticated OS command execution; it does not mention any PoC, exploit, patch, or active exploitation.
00000117
56.7K followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash205d
Disclosure
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-32298 - Angeet ES3 KVM OS command injection Intel Report: https://ift.tt/o2TRFuc
Post summary
The tweet announces CVE-2026-32298, reporting an OS command injection flaw in Angelet ES3 KVM, and links to an Intel report.
0000027
336 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds205d
Disclosure
CVE-2026-32298 Authenticated Command Injection in Angeet ES3 KVM via 'cf... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-32298 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The post announces CVE-2026-32298, an authenticated command injection flaw in Angeet ES3 KVM, linking to vulnerability details but without mention of an exploit, patch, or active exploitation.
0000045
4.0K followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash205d
Disclosure
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-32298 - Angeet ES3 KVM OS command injection Intel Report: https://ift.tt/5Ypft1T
Post summary
A security alert announces CVE-2026-32298, a command‑injection flaw in Angeet ES3 KVM, with no evidence of exploitation or mitigation details.
0000031
336 followersView on X
CVEFind.com@CveFindCom205d
Disclosure
[CVE-2026-32298: CRITICAL] The Angeet ES3 KVM does not properly sanitize user-supplied variables parsed by the 'cfg.lua' script, allowing an authenticated attacker to execute OS-level commands.#cve,CVE-2026-32298,#cybersecurity https://cvefind.com/CVE-2026-32298
Post summary
The message announces a critical vulnerability in Angeet ES3 KVM that permits authenticated attackers to execute OS‑level commands via unsanitized cfg.lua variables.
00000109
602 followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
HW	angeet	es3_kvm	-	-	-
OS	angeet	es3_kvm_firmware	-	-	-

Explore more

Back to dashboard angeet CVEs es3_kvm vulnerabilities

What researchers are saying

CVE-2026-32298

The Hacker Wire@TheHackerWireDisclosure

The tweet announces CVE‑2026‑32298, a critical flaw in Angeet ES3 KVM that lets authenticated users run arbitrary OS commands due to unsanitized variables in cfg.lua.

CVE@CVEnewDisclosure

The post gives a concise vulnerability description for CVE-2026-32298, highlighting a flaw in Angeet ES3 KVM’s cfg.lua script that allows authenticated OS command execution; it does not mention any PoC, exploit, patch, or active exploitation.

CyberDudeBivash® | Global Cybersecurity Company@cyberbivashDisclosure

The tweet announces CVE-2026-32298, reporting an OS command injection flaw in Angelet ES3 KVM, and links to an Intel report.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The post announces CVE-2026-32298, an authenticated command injection flaw in Angeet ES3 KVM, linking to vulnerability details but without mention of an exploit, patch, or active exploitation.

CyberDudeBivash® | Global Cybersecurity Company@cyberbivashDisclosure

A security alert announces CVE-2026-32298, a command‑injection flaw in Angeet ES3 KVM, with no evidence of exploitation or mitigation details.

CVEFind.com@CveFindComDisclosure

The message announces a critical vulnerability in Angeet ES3 KVM that permits authenticated attackers to execute OS‑level commands via unsanitized cfg.lua variables.