JetKVM devices prior to 0.5.4 provide no rate limiting on login attempts, enabling attackers to perform brute‑force credential guessing. The vulnerability is classified as CWE‑307. If credentials are discovered, the attacker could log into the KVM web interface, but the extent of control beyond this is inferred and not explicitly stated in the advisory.

All JetKVM KVM devices running firmware or software versions earlier than 0.5.4 are affected. The vendor released version 0.5.4 which added login rate limiting; any device still on earlier releases lacks this protection.

The CVSS score of 9.3 indicates a high severity risk. The EPSS score of less than 1 % suggests that exploitation is relatively uncommon to date, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is over the network through the KVM login interface, inferred from the description that login requests are processed without limitation.