7.0 HighCWE-306
CVE-2026-32291
GL-iNet Comet (GL-RM1) KVM unauthenticated root access via UART serial console
GL-iNetComet KVM
Status
- Not in CISA KEV
- Fixed in version 1.8.2
Exploit probabilityEPSSchecked 25 Oct
0.3%probability of exploitation in the next 30 days
Higher than 28% of scored CVEs
SeverityCVSS
7.0High
Description NVD
The GL-iNet Comet (GL-RM1) KVM before 1.8.2 does not require authentication on the UART serial console. This attack requires physically opening the device and connecting to the UART pins.
Coverage 1 article · 1 outlet
- 9 Critical IP KVM Flaws Enable Unauthenticated Root Access Across Four VendorsThe Hacker News · first in our coverage · mentions it in passing