The GL-iNet Comet (GL-RM1) KVM connects to a GL-iNet site during boot-up to provision client and CA certificates.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 17, 2026 · NIST NVD

   Detected

   The GL-iNet Comet (GL-RM1) KVM connects to a GL-iNet site during boot-up to provision client and CA certificates. The GL-RM1 does not verify certificates used for this connection, allowing an attacker-in-the-middle to serve invalid client and CA certificates. The GL-RM1 will attempt to use the invalid certificates and fail to connect to the legitimate GL-iNet KVM cloud service.

2. Jun 17, 2026 · NIST NVD

   Updated

   The GL-iNet Comet (GL-RM1) KVM connects to a GL-iNet site during boot-up to provision client and CA certificates. The GL-RM1 does not verify certificates used for this connection, allowing an attacker-in-the-middle to serve invalid client and CA certificates. The GL-RM1 will attempt to use the invalid certificates and fail to connect to the legitimate GL-iNet KVM cloud service.

Affected

• cpe gl-inet/comet gl-rm1 firmwareversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-32293

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-32293

  The GL-iNet Comet (GL-RM1) KVM connects to a GL-iNet site during boot-up to provision client and CA certificates. The GL-RM1 does not verify certificates used for this connection, allowing an attacker-in-the-middle to serve invalid client and CA certificates. The GL-RM1 will atte

  nvd.nist.gov

References

• Release Notes · dl.gl-inet.com
• Third Party Advisory · eclypsium.com
• Broken Link · raw.githubusercontent.com
• Third Party Advisory · cve.org