ZeroDay Findings
Sign inSign up

Findings

CVE-2026-32291

The GL-iNet Comet (GL-RM1) KVM before 1.8.2 does not require authentication on the UART serial console.

Published Mar 17, 2026 · updated Jun 17, 2026 · gl-inet comet gl-rm1 firmware

The GL-iNet Comet (GL-RM1) KVM before 1.8.2 does not require authentication on the UART serial console. This attack requires physically opening the device and connecting to the UART pins.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 17, 2026 · NIST NVD

    Detected

    The GL-iNet Comet (GL-RM1) KVM before 1.8.2 does not require authentication on the UART serial console. This attack requires physically opening the device and connecting to the UART pins.

  2. Jun 17, 2026 · NIST NVD

    Updated

    The GL-iNet Comet (GL-RM1) KVM before 1.8.2 does not require authentication on the UART serial console. This attack requires physically opening the device and connecting to the UART pins.

Affected

  • cpe gl-inet/comet gl-rm1 firmwareversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-32291

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-32291

    The GL-iNet Comet (GL-RM1) KVM before 1.8.2 does not require authentication on the UART serial console. This attack requires physically opening the device and connecting to the UART pins.

    nvd.nist.gov

References