⚙️
You probably think of your home security system as something that protects your privacy — cameras, locks, alarms, all pointed outward. But there’s a class of device that works in the opposite direction, and it’s sitting on more remote workers’ desks than most people realize. KVM-over-IP gadgets let you control a computer from anywhere with full keyboard, video, and mouse access, even at the BIOS level, below the operating system entirely. They’re sold as convenient tools for IT troubleshooting or accessing a work machine from a home setup. And according to research from Eclypsium, many of the cheap, popular models ship with vulnerabilities that could let an attacker take them over completely — and from there, reach every machine you connect to them.
The kicker is not just that the devices are insecure. It’s that they operate outside your computer’s normal security controls — no antivirus, no firewall, no endpoint detection can see what they’re doing. A compromised KVM device becomes a backdoor that can inject keystrokes, disable disk encryption, and re-infect a machine even after a full wipe. Most of what’s documented here about these specific hardware flaws comes from Eclypsium’s reporting on nine vulnerabilities across four low-cost models.
Hardware security
Remote access tools
Privacy boundaries
What a KVM device actually does — and why that matters for your home office
A KVM switch, in its simplest form, lets you use one keyboard, monitor, and mouse to control multiple computers. The “over IP” version adds networking: you can sit in your home office and control a work laptop that’s physically in another room, or access a server in a colocation facility across town. Enterprise-grade rack-mounted KVM switches include features like encryption, multi-factor authentication, and activity logging — but they cost hundreds or thousands of dollars. The compact single-port devices that budget-constrained IT teams and small businesses have been buying instead run Linux-based firmware with far weaker access controls.
Eclypsium researchers found that the number of these devices exposed directly to the internet grew from a few hundred to over 1,600 in less than a year. Users include small IT shops, managed service providers, and enterprises across data centers, healthcare facilities, government installations, and industrial environments. The most severe flaw they identified carries a CVSS score of 9.8 — that’s critical. In the Angeet/Yeeso ES3 KVM, an unprotected file upload endpoint lets any attacker with network access write arbitrary files, which can be chained with a command injection flaw to achieve pre-authentication remote code execution with root privileges. Angeet committed to fixing the issue but provided no timeline.
The GL-iNet Comet RM-1 had four vulnerabilities: no brute-force protection on login, an insecure provisioning connection, use of the outdated MD5 hash for firmware updates with no cryptographic signature (allowing an attacker to push backdoored firmware), and an exposed UART serial interface that provides unauthenticated root access with physical access. GL-iNet issued partial fixes in beta but has no planned fix for the firmware signing or UART authentication issues. JetKVM’s OTA update mechanism relied on SHA-256 hashes without cryptographic signatures, and its single-password login had no brute-force protection — both flaws have been patched. Sipeed NanoKVM had an unauthenticated WiFi configuration endpoint that could be exploited to hijack the network connection; that flaw has also been patched.
A compromised KVM device doesn’t just give an attacker access to your files. It gives them control at the firmware level — the ability to inject keystrokes that can disable disk encryption, alter UEFI settings, or re-infect a system after it’s been wiped. Because the device operates outside the controlled operating system, endpoint detection tools and host firewalls cannot see its activity. It’s the equivalent of handing someone physical access to every machine you connect, and they can hide malware on the KVM’s own Linux firmware between attacks.
When the privacy invasion is a feature, not a bug
The KVM story is dramatic, but it’s part of a larger pattern: the tools we use to work remotely collect, transmit, and sometimes expose far more than we intend. A scenario-based survey of 214 US-based workers who work from home regularly found that 93.9% had experienced at least one privacy-invasive situation during a remote call or meeting. More than half — 65.4% — felt uncomfortable during at least one of those experiences.
The survey, conducted by researchers and published on arXiv, presented participants with 14 scenarios across four categories: audio (someone’s voice, a child, a pet, an object sound inadvertently picked up), video (similar inadvertent captures), data (emails, files, or browsing history displayed on a shared screen), and autonomy (being prohibited from turning off the camera or microphone when urgently needed). Audio scenarios were the most commonly experienced — 87.4% of participants had at least one — and they caused discomfort more reliably than video. But the autonomy scenarios, though least experienced, produced the highest discomfort rates: 84.8% of those who couldn’t stop their camera felt uncomfortable, and 81.3% of those who couldn’t stop their microphone.
Of the five audio scenarios, the one involving another adult’s voice being picked up was the most common — 72.9% of participants had experienced it. Voice_child came next at 58.4%, then sound_object at 57.0%. Discomfort rates for these audio scenarios ranged from 28.6% (hearing your own voice) to 51.6% (hearing another adult). The researchers noted that audio privacy invasions caused more discomfort than video overall — 46.2% of audio scenarios caused discomfort versus 28.8% of video scenarios. These numbers align with something many remote workers have felt but maybe haven’t said out loud: it’s often harder to control what’s heard than what’s seen.
The survey also found that most participants who felt uncomfortable said the discomfort did not escalate to cause harm — 74.3% reported no harm. Of those who did report harm, it was almost always minor and psychological. But the fact that harm is usually minor doesn’t mean it’s irrelevant. The researchers point out that in the US, where employment is at-will, workers may self-censor their home environments to align with perceived social expectations — and privacy-protecting behaviors can also be employment-protecting behaviors. When you can’t afford to risk your job, you tolerate the minor discomforts and keep working.
Manual measures beat smart ones — and the reasons are telling
One of the more practical findings from the survey concerns how people actually protect themselves. Across all categories, manual measures were used far more often than smart ones. Covering the camera with tape or a slide cover: 43.0% of participants did this, versus 24.0% who used a virtual background. Toggling the microphone on and off: 51.9% manual, versus 13.1% who used noise cancellation settings. Closing tabs and apps before screen sharing: 28.0% manual, versus 8.4% who used screen share controls. Violating employer rules to protect autonomy: 15.4% manual, versus 4.2% who used settings.
The reasons participants gave for not using protective measures are worth noting: they weren’t aware the feature existed, the feature wasn’t available in their tool, it was too much effort or inconvenient, they trusted their colleagues or employer, they weren’t concerned about the scenario, their employer prohibited disabling the camera or microphone, the feature degraded quality (virtual backgrounds glitching), or they simply forgot.
- Keep a physical camera cover — a slide or a piece of opaque tape. It’s the cheapest, most reliable way to ensure the camera sees only what you want it to see, and it works regardless of what software you’re using.
- Mute by default, unmute to speak. This sounds trivial, but the survey found it was the most mentioned audio protection strategy. It requires no special settings and works across every platform.
- Use a separate browser profile for work. If you share your screen, your personal tabs — social media, email, shopping, medical portals — stay in a different window. Close the work profile’s tabs before sharing, and you eliminate most data exposure risks.
- Know your employer’s actual monitoring tools. Common software like Microsoft Office and Zoom have tracking features built in, but they aren’t always activated. Asking IT or your manager directly — “What employee data does the organization collect, and how is it used?” — can clarify what’s actually being tracked.
And then there’s the autonomy piece. The survey found that participants violated or would violate employer rules that restricted their ability to turn off the camera or microphone when they needed privacy. This is not theoretical — 15.4% of participants reported doing it. The researchers frame this as a rational trade-off: when the choice is between violating a policy and having a private conversation or attending to an urgent personal need, most people choose the policy violation. The discomfort from autonomy-restricting scenarios was the highest in the study.
Workplace surveillance is already collecting more than you think
The KVM vulnerabilities and the privacy survey both point toward a broader reality that the LA Times reported on in 2026: thousands of employers now use technology to track worker whereabouts, productivity, and communications — and the tools share names, email addresses, and personal worker data with hundreds of outside data brokers and technology companies, often without clear disclosure. An investigation by Vanderbilt University, Northeastern University, and UC Berkeley found this data-sharing ecosystem operating beneath the surface of routine workplace monitoring programs.
Workers with the least labor market power tend to be the testing grounds for the most intrusive data collection. Pharmacist Lannie Duong, featured in the LA Times reporting, had her employer track the length of her phone calls and appointments, questioning why she took so long with each patient. She described feeling not trusted, not appreciated, hopeless. She went on medical leave, organized a union, and her employment was terminated after the leave. Duong’s story is one example among many, but it illustrates a pattern: the monitoring tools that start in call centers and retail often migrate to professional work-from-home roles as the technology gets cheaper and easier to deploy.
Adjunct professor Arianna Anaya discovered that an administrator at her school was reading student papers uploaded to the learning management system — and reading her comments on those papers. Students had written about intimate topics: abuse, eating disorders, family trauma. The school used the online learning system to allow administrators and staff to read student work that students had no reason to believe was visible to anyone but the instructor. A colleague printed the comments, criticized Anaya’s casual tone, and accused her of not sticking to the syllabus. Her teaching contract was not renewed a few months later. Anaya told the LA Times the incident made her paranoid and feel less safe.
These are not KVM vulnerabilities. They are organizational vulnerabilities — decisions about who can see what, made without transparency, that erode trust and create real consequences. But they converge on the same point: the tools we use for remote work collect data we don’t always know about, and that data can be accessed by people we didn’t expect to see it.
New York, Connecticut, Delaware, and Maine require employers to notify workers if they are being monitored. Maine goes further: it prohibits visual monitoring in employees’ homes or personal vehicles unless it’s required for job duties — for example, a telehealth nurse who needs a camera to do her job. A productivity webcam bolted onto ordinary desk work would almost certainly not qualify. These laws are relatively recent, and enforcement mechanisms are still being tested, but they establish a baseline: workers have a right to know what’s being collected.
In states without notification requirements, it can be difficult to find out whether an employer uses technology to monitor performance. The LA Times article suggests approaching the question cautiously — “How is this information being used within the company? How might it get out of the company?” — and coordinating with a union if one exists. If your manager doesn’t know what data is collected, the IT department may have answers. The difficulty of finding out is itself a privacy risk: if you don’t know what’s being tracked, you can’t make informed decisions about what to do on a work device.
What to do when the device you control isn’t really under your control
Let’s bring this back to the KVM problem, because it’s the one with a clear technical fix. Eclypsium’s researchers advise a set of practices that apply whether you’re an IT manager deploying these devices or a remote worker who happens to use one:
- Isolate KVM devices on dedicated management VLANs. Don’t put them on the same network segment as your regular work devices. If someone compromises the KVM, they can’t pivot to your laptop directly.
- Never expose KVM devices directly to the internet. The researchers found over 1,600 devices exposed in less than a year. A KVM should be accessible only via VPN or another authenticated tunnel.
- Deploy two-factor authentication when available. Not all cheap KVM devices support it, but if yours does, use it. If it doesn’t, consider whether the convenience is worth the risk.
- Audit your network for unknown KVM devices. If you didn’t install it and don’t know where it came from, treat it as a security finding until proven otherwise.
- Apply firmware updates when available. Some vendors have patched specific flaws (JetKVM, Sipeed). Others have not. Know which category your device falls into.
For the broader privacy concerns — the accidental audio capture, the shared screen that reveals too much, the employer monitoring you didn’t authorize — the fixes are more about habits and awareness than hardware. The survey data suggests that manual measures are already more common than smart ones, and that’s fine. A piece of tape on the camera works. Muting the microphone by default works. Closing tabs before sharing works. These are not sophisticated solutions, but they are effective, and they don’t depend on your employer’s IT policies or the specific software you’re using.
Possibly. If you use any device that gives you remote control of another computer — a PiKVM, a JetKVM, or similar — you’re in the risk category. The Eclypsium research also noted that North Korean spies posing as remote workers used PiKVM devices connected to employer-provided laptops and workstations to fake physical presence in different countries and gain corporate network access. That’s an extreme case, but it demonstrates what the device class is capable of. If you don’t use a KVM device, you’re not directly affected by these specific vulnerabilities, but the broader point about devices that operate below the OS level applies to any hardware with remote management capabilities — including the BMC interfaces built into many server motherboards, which have been plagued by vulnerabilities for years.
Most of what’s documented here comes from a small set of sources: Eclypsium’s vulnerability research, the arXiv survey of 214 WFH workers, and the LA Times reporting on workplace surveillance. Each tells a different part of the same story. The hardware vulnerabilities show that the tools we buy can be weaponized against us. The survey shows that the privacy invasions we experience are common, often uncomfortable, and rarely escalate to serious harm — but that doesn’t mean they’re trivial. The surveillance reporting shows that the organizations we work for may be collecting data we don’t know about, sharing it with partners we never agreed to, and using it in ways that affect our careers.
The thread that connects all three is the assumption that the tools we use are neutral. They’re not. Every device, every platform, every monitoring setting carries design choices about who sees what and how much control the user has. The KVM vulnerabilities are a particularly stark example because they involve a device that is supposed to give you control, but that can be turned against you. The privacy survey is a reminder that even without malicious actors, the ordinary use of these tools creates exposure. And the surveillance reporting is a warning that the exposure is not always accidental — sometimes it’s the point.
I find myself checking more carefully before I share my screen now. I look at the list of open tabs, and I think about whether any of them contain something I wouldn’t want a colleague to see. I’ve started muting my microphone by default even in meetings where I’m the only speaker. These are small adjustments, and they don’t solve the structural problems — the insecure firmware, the opaque data collection, the employer who tracks every call length. But they are adjustments I can make on my own, without waiting for a vendor patch or a policy change. That’s not a satisfying conclusion, but it’s an honest one.