GCVE - cpe:2.3:o:gl-inet:comet_gl-rm1_firmware:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:o:gl-inet:comet_gl-rm1_firmware:*:*:*:*:*:*:*:*

part: o version: * update: *

Vendor	Gl Inet (`0ba6498a-0971-5dec-92da-bb83b4dab2f2`)
Product	Comet Gl Rm1 Firmware (`1e4d5737-3823-586c-bc2d-57cd4347d9e6`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-32293`	vulnerable	2026-06-08 07:57:17.372668	GL-iNet Comet (GL-RM1) KVM insufficient certificate validation LOW (3.7) The GL-iNet Comet (GL-RM1) KVM connects to a GL-iNet site during boot-up to provision client and CA certificates. The GL-RM1 does not verify certificates used for this connection, allowing an attacker-in-the-middle to serve invalid client and CA certificates. The GL-RM1 will attempt to use the invalid certificates and fail to connect to the legitimate GL-iNet KVM cloud service. Published: 2026-03-17T17:19:07.549Z Updated: 2026-03-23T19:34:57.871Z Open on db.gcve.eu Reference links https://eclypsium.com/blog/your-kvm-is-the-weak-link-how-30-dollar-devices-can-own-your-entire-network/ https://www.cve.org/CVERecord?id=CVE-2026-32293 https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-076-01.json https://dl.gl-inet.com/release/kvm/release/RM1/1.7.2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-32292`	vulnerable	2026-06-08 07:57:17.372291	GL-iNet Comet (GL-RM1) KVM insufficient login rate-limiting HIGH (7.5) The GL-iNet Comet (GL-RM1) KVM web interface does not limit login requests, enabling brute-force attempts to guess credentials. Published: 2026-03-17T17:18:54.851Z Updated: 2026-03-23T19:34:33.902Z Open on db.gcve.eu Reference links https://eclypsium.com/blog/your-kvm-is-the-weak-link-how-30-dollar-devices-can-own-your-entire-network/ https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-076-01.json https://www.cve.org/CVERecord?id=CVE-2026-32292 https://dl.gl-inet.com/release/kvm/release/RM1/1.7.2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-32291`	vulnerable	2026-06-08 07:57:17.369865	GL-iNet Comet (GL-RM1) KVM unauthenticated root access via UART serial console MEDIUM (6.8) The GL-iNet Comet (GL-RM1) KVM before 1.8.2 does not require authentication on the UART serial console. This attack requires physically opening the device and connecting to the UART pins. Published: 2026-03-17T17:18:34.947Z Updated: 2026-03-23T19:34:20.347Z Open on db.gcve.eu Reference links https://eclypsium.com/blog/your-kvm-is-the-weak-link-how-30-dollar-devices-can-own-your-entire-network/ https://www.cve.org/CVERecord?id=CVE-2026-32291 https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-076-01.json https://dl.gl-inet.com/release/kvm/release/RM1/1.8.2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-32290`	vulnerable	2026-06-08 07:57:17.368870	GL-iNet Comet (GL-RM1) KVM insufficient firmware verification MEDIUM (4.7) The GL-iNet Comet (GL-RM1) KVM before version 1.8.2 does not sufficiently verify the authenticity of uploaded firmware files. An attacker-in-the-middle or a compromised update server could modify the firmware and the corresponding MD5 hash to pass verification. Published: 2026-03-17T17:18:14.150Z Updated: 2026-03-23T19:34:09.794Z Open on db.gcve.eu Reference links https://eclypsium.com/blog/your-kvm-is-the-weak-link-how-30-dollar-devices-can-own-your-entire-network/ https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-076-01.json https://www.cve.org/CVERecord?id=CVE-2026-32290 https://dl.gl-inet.com/release/kvm/release/RM1/1.8.2	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.