PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-32290 GL-iNet CVE debrief

The GL-iNet Comet (GL-RM1) KVM before version 1.8.2 has a vulnerability that allows an attacker-in-the-middle or a compromised update server to modify the firmware and the corresponding MD5 hash to pass verification. This issue arises from insufficient verification of uploaded firmware files. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 4.7, indicating a medium severity level. The vulnerability was published on March 17, 2026, and last modified on March 24, 2026. To address this issue, users should update to version 1.8.2 or later. The CVSS vector for this vulnerability is CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N.

Vendor
GL-iNet
Product
Comet KVM
CVSS
MEDIUM 4.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-17
Original CVE updated
2026-03-24
Advisory published
2026-03-17
Advisory updated
2026-03-24

Who should care

Organizations and individuals using the GL-iNet Comet (GL-RM1) KVM with firmware versions prior to 1.8.2 should be aware of this vulnerability. This includes IT administrators, cybersecurity professionals, and users of the affected product. Given the medium severity of this vulnerability, it is essential for those responsible for maintaining the security of their systems to take appropriate measures to mitigate the risk.

Technical summary

The GL-iNet Comet (GL-RM1) KVM before version 1.8.2 does not sufficiently verify the authenticity of uploaded firmware files. This allows an attacker-in-the-middle or a compromised update server to modify the firmware and the corresponding MD5 hash to pass verification. The vulnerability has a CVSS score of 4.7 and a vector of CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N. The issue was published on March 17, 2026, and last modified on March 24, 2026. The fix for this vulnerability is included in version 1.8.2 or later.

Defensive priority

Medium priority should be given to updating the GL-iNet Comet (GL-RM1) KVM to version 1.8.2 or later to address the insufficient firmware verification vulnerability. This update will help prevent potential attacks that could modify firmware and pass verification.

Recommended defensive actions

  • Update the GL-iNet Comet (GL-RM1) KVM to version 1.8.2 or later.
  • Verify the authenticity of firmware files before uploading.
  • Use secure channels for firmware updates.
  • Monitor for any suspicious activity related to firmware updates.
  • Consider implementing additional security measures such as validating the integrity of firmware files using digital signatures.

Evidence notes

The information provided is based on the CVE-2026-32290 record and the source item from CISA CSAF. The CVE record and source item provide details about the vulnerability, its impact, and the available fix. The CVSS score and vector give an indication of the severity and characteristics of the vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-32290 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-32290

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-32290 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-32290

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-076-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-076-01.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://eclypsium.com/blog/your-kvm-is-the-weak-link-how-30-dollar-devices-can-own-your-entire-network/

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://dl.gl-inet.com/release/kvm/release/RM1/1.8.2

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.