JetKVM devices before version 0.5.4 lack any mechanism to limit the number of login attempts, permitting attackers to perform brute‑force attacks against the device’s authentication. The vulnerability is classified as CWE‑307 (Improper Restriction of Excessive Authentication Attempts). Successful exploitation results in compromised credentials and subsequent unauthorized access to the virtual machine, exposing the underlying host to full control by the attacker.

Affected vendor is JetKVM, product JetKVM. Any deployed JetKVM device running a software version earlier than 0.5.4 is susceptible. The associated release information can be found in the vendor’s release notes for release/0.5.4.

The CVSS score of 9.3 indicates a high severity risk. The EPSS score is not available, but the absence of rate limiting makes automated exploitation highly feasible. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote over the network, where an attacker can repeatedly attempt credentials until success. Once authenticated, the attacker gains full control of the virtual machine and, by extension, the host system.