ZeroDay Findings
Sign inSign up

Findings

CVE-2026-32290

The GL-iNet Comet (GL-RM1) KVM before version 1.8.2 does not sufficiently verify the authenticity of uploaded firmware files.

Published Mar 17, 2026 · updated Jun 17, 2026 · gl-inet comet gl-rm1 firmware

The GL-iNet Comet (GL-RM1) KVM before version 1.8.2 does not sufficiently verify the authenticity of uploaded firmware files. An attacker-in-the-middle or a compromised update server could modify the firmware and the corresponding MD5 hash to pass verification.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 17, 2026 · NIST NVD

    Detected

    The GL-iNet Comet (GL-RM1) KVM before version 1.8.2 does not sufficiently verify the authenticity of uploaded firmware files. An attacker-in-the-middle or a compromised update server could modify the firmware and the corresponding MD5 hash to pass verification.

  2. Jun 17, 2026 · NIST NVD

    Updated

    The GL-iNet Comet (GL-RM1) KVM before version 1.8.2 does not sufficiently verify the authenticity of uploaded firmware files. An attacker-in-the-middle or a compromised update server could modify the firmware and the corresponding MD5 hash to pass verification.

Affected

  • cpe gl-inet/comet gl-rm1 firmwareversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-32290

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-32290

    The GL-iNet Comet (GL-RM1) KVM before version 1.8.2 does not sufficiently verify the authenticity of uploaded firmware files. An attacker-in-the-middle or a compromised update server could modify the firmware and the corresponding MD5 hash to pass verification.

    nvd.nist.gov

References