Comet Gl Rm1 Firmware

comet_gl-rm1_firmware

Vendor: Gl Inet • 4 CVEs

CVEs (4)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-32293 1Gl Inet 1Comet Gl Rm1 Firmware Jun 17, 2026 Mar 17, 2026 6.3 MEDIUM· v4 3.7 LOW· v3 N/A· v2 The GL-iNet Comet (GL-RM1) KVM connects to a GL-iNet site during boot-up to provision client and CA certificates. The GL-RM1 does not verify certificates used for this connection, allowing an attacker-in-the-middle to se...Show more The GL-iNet Comet (GL-RM1) KVM connects to a GL-iNet site during boot-up to provision client and CA certificates. The GL-RM1 does not verify certificates used for this connection, allowing an attacker-in-the-middle to serve invalid client and CA certificates. The GL-RM1 will attempt to use the invalid certificates and fail to connect to the legitimate GL-iNet KVM cloud service.Show less
CVE-2026-32292 1Gl Inet 1Comet Gl Rm1 Firmware Jun 17, 2026 Mar 17, 2026 9.3 CRITICAL· v4 7.5 HIGH· v3 N/A· v2 The GL-iNet Comet (GL-RM1) KVM web interface does not limit login requests, enabling brute-force attempts to guess credentials.
CVE-2026-32291 1Gl Inet 1Comet Gl Rm1 Firmware Jun 17, 2026 Mar 17, 2026 7.0 HIGH· v4 6.8 MEDIUM· v3 N/A· v2 The GL-iNet Comet (GL-RM1) KVM before 1.8.2 does not require authentication on the UART serial console. This attack requires physically opening the device and connecting to the UART pins.
CVE-2026-32290 1Gl Inet 1Comet Gl Rm1 Firmware Jun 17, 2026 Mar 17, 2026 7.0 HIGH· v4 4.7 MEDIUM· v3 N/A· v2 The GL-iNet Comet (GL-RM1) KVM before version 1.8.2 does not sufficiently verify the authenticity of uploaded firmware files. An attacker-in-the-middle or a compromised update server could modify the firmware and the cor...Show more The GL-iNet Comet (GL-RM1) KVM before version 1.8.2 does not sufficiently verify the authenticity of uploaded firmware files. An attacker-in-the-middle or a compromised update server could modify the firmware and the corresponding MD5 hash to pass verification.Show less