9.3 CriticalCWE-307
CVE-2026-32292
GL-iNet Comet (GL-RM1) KVM insufficient login rate-limiting
GL-iNetComet KVM
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 23 Oct
0.6%probability of exploitation in the next 30 days
Higher than 47% of scored CVEs
SeverityCVSS
9.3Critical
Description NVD
The GL-iNet Comet (GL-RM1) KVM web interface does not limit login requests, enabling brute-force attempts to guess credentials.
Coverage 1 article · 1 outlet
- 9 Critical IP KVM Flaws Enable Unauthenticated Root Access Across Four VendorsThe Hacker News · first in our coverage · mentions it in passing