JetKVM devices before version 0.5.4 do not verify the authenticity of downloaded firmware. An attacker who can observe or manipulate the update stream can replace the firmware image and its SHA256 hash, causing the device to install a tampered version. The compromised firmware can execute arbitrary code on the KVM device, undermining its integrity and potentially enabling further attacks against connected systems.

The vulnerability affects all JetKVM devices running firmware versions older than 0.5.4. Any unit relying on the default update mechanism without additional verification is at risk.

The CVSS score of 7 indicates a high severity, while an EPSS score of less than 1% shows a low to moderate likelihood of exploitation. The absence from the CISA KEV catalog does not diminish the potential impact. Exploitation would require the attacker to intercept or control the firmware update process, a scenario that is plausible for a malicious or compromised update server or for an attacker with network access to the device. Once successful, the attacker could achieve persistent remote code execution on the affected KVM unit.