Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-32293

GL-iNet Comet (GL-RM1) KVM insufficient certificate validation

The GL-iNet Comet (GL-RM1) KVM connects to a GL-iNet site during boot-up to provision client and CA certificates. The GL-RM1 does not verify certificates used for this connection, allowing an attacker-in-the-middle to serve invalid client and CA certificates. The GL-RM1 will attempt to use the invalid certificates and fail to connect to the legitimate GL-iNet KVM cloud service.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gl-inet
Products
Comet Gl-rm1 Comet Gl-rm1 Firmware Comet Kvm
CVE-2026-32291

GL-iNet Comet (GL-RM1) KVM unauthenticated root access via UART serial console

The GL-iNet Comet (GL-RM1) KVM before 1.8.2 does not require authentication on the UART serial console. This attack requires physically opening the device and connecting to the UART pins.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Gl-inet
Products
Comet Gl-rm1 Comet Gl-rm1 Firmware Comet Kvm
CVE-2026-32290

GL-iNet Comet (GL-RM1) KVM insufficient firmware verification

The GL-iNet Comet (GL-RM1) KVM before version 1.8.2 does not sufficiently verify the authenticity of uploaded firmware files. An attacker-in-the-middle or a compromised update server could modify the firmware and the corresponding MD5 hash to pass verification.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Gl-inet
Products
Comet Gl-rm1 Comet Gl-rm1 Firmware Comet Kvm