CVE-2026-32291

7.0 highEPSS 0.3%

The GL-iNet Comet (GL-RM1) KVM before 1.8.2 does not require authentication on the UART serial console. This attack requires physically opening the device and connecting to the UART pins.

Severity

CVSS 4.0

7.0 high

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

6.8 medium

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 28% of CVEs (scores of 2026-10-31)
CWE: CWE-306
Published: 2026-03-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

gl-inet:comet_gl-rm1_firmware

References

https://dl.gl-inet.com/release/kvm/release/RM1/1.8.2
https://eclypsium.com/blog/your-kvm-is-the-weak-link-how-30-dollar-devices-can-own-your-entire-network/
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-076-01.json
https://www.cve.org/CVERecord?id=CVE-2026-32291

Check your stack JSON