JetKVM prior to 0.5.4 does not verify the authenticity of downloaded firmware files. This allows an attacker in‑the‑middle or a compromised update server to modify the firmware and its corresponding SHA256 hash so that the device incorrectly accepts the tampered firmware. The vulnerability is a legitimate example of missing data validation (CWE‑345) and absence of integrity checks (CWE‑347). Installing the malicious firmware can give an attacker full control of the device, enabling arbitrary code execution, data theft, or disruption of services.

All JetKVM devices running firmware versions earlier than 0.5.4 are affected. No other vendors or products are listed.

A CVSS score of 7 indicates a high severity level. EPSS data is not available, and the vulnerability is not currently listed in the CISA KEV catalog. The most likely attack vector is a network‑based compromise: either a man‑in‑the‑middle position intercepting the update traffic or a compromised update server providing a dishonest firmware image. The attack does not require local privileges; any entity with access to the device’s update channel can exploit it.