7.0 HighCWE-345
CVE-2026-32290
GL-iNet Comet (GL-RM1) KVM insufficient firmware verification
GL-iNetComet KVM
Status
- Not in CISA KEV
- Fixed in version 1.8.2
Exploit probabilityEPSSchecked 25 Oct
0.2%probability of exploitation in the next 30 days
Higher than 6% of scored CVEs
SeverityCVSS
7.0High
Description NVD
The GL-iNet Comet (GL-RM1) KVM before version 1.8.2 does not sufficiently verify the authenticity of uploaded firmware files. An attacker-in-the-middle or a compromised update server could modify the firmware and the corresponding MD5 hash to pass verification.
Coverage 1 article · 1 outlet
- 9 Critical IP KVM Flaws Enable Unauthenticated Root Access Across Four VendorsThe Hacker News · first in our coverage