Sipeed NanoKVM devices prior to firmware 2.3.1 expose a Wi‑Fi configuration endpoint that lacks authentication checks. An attacker with local network access can send HTTP requests that overwrite the stored Wi‑Fi credentials with attacker‑chosen values or trigger memory exhaustion, causing the KVM process to terminate. This flaw results in unauthorized configuration changes and potential denial of service, and is classified as CWE‑306, Access Control—Missing Authentication for Request.

The vulnerability affects all Sipeed NanoKVM firmware versions earlier than 2.3.1. The affected vendor is Sipeed, product NanoKVM. Specific firmware versions are identified only as those preceding 2.3.1; no further sub‑versions are listed in the CVE data.

The CVSS base score of 8.8 indicates high severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only connectivity to the target device’s network interface; no credentials are needed. An attacker can exploit the flaw by sending crafted HTTP requests to the unlocked endpoint, leading to configuration manipulation or a deliberate denial of service via memory exhaustion.