CVE-2026-32291

MEDIUM

GL-iNet Comet (GL-RM1) KVM unauthenticated root access via UART serial console

Title source: cna
STIX 2.1

Description

The GL-iNet Comet (GL-RM1) KVM before 1.8.2 does not require authentication on the UART serial console. This attack requires physically opening the device and connecting to the UART pins.

References (4)

Scores

CVSS v3 6.8
EPSS 0.0005
EPSS Percentile 16.8%
Attack Vector PHYSICAL
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-306
Status published
Products (2)
GL-iNet/Comet KVM
gl-inet/comet_gl-rm1_firmware < 1.8.2
Published Mar 17, 2026
Tracked Since Mar 17, 2026