PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-32291 GL-iNet CVE debrief

The GL-iNet Comet (GL-RM1) KVM before version 1.8.2 has a critical vulnerability that allows unauthenticated root access via the UART serial console. This attack requires physical access to the device and connection to the UART pins. The vulnerability was reported on March 10, 2026, and publicly disclosed on March 17, 2026. The CVSS score for this vulnerability is 6.8, indicating a medium severity. The vulnerability was fixed in version 1.8.2, released on March 20, 2026.

Vendor
GL-iNet
Product
Comet KVM
CVSS
MEDIUM 6.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-17
Original CVE updated
2026-03-24
Advisory published
2026-03-17
Advisory updated
2026-03-24

Who should care

Organizations using the GL-iNet Comet (GL-RM1) KVM, especially those in industries requiring high security, should prioritize patching this vulnerability. Physical security of devices is crucial, as an attacker with physical access can exploit this vulnerability. IT teams responsible for managing KVM devices should be aware of this risk and take immediate action.

Technical summary

The GL-iNet Comet (GL-RM1) KVM before 1.8.2 lacks authentication on the UART serial console, allowing an attacker with physical access to gain root access. The vulnerability is characterized by CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The attack requires physically opening the device and connecting to the UART pins. This vulnerability was reported on March 10, 2026, and patched on March 20, 2026. The fix is available in version 1.8.2.

Defensive priority

High priority should be given to patching GL-iNet Comet (GL-RM1) KVM devices to version 1.8.2 or later. Physical security measures should be reviewed to prevent unauthorized access to devices.

Recommended defensive actions

  • Patch GL-iNet Comet (GL-RM1) KVM to version 1.8.2 or later immediately.
  • Review physical security measures to prevent unauthorized access to devices.
  • Inventory and monitor GL-iNet Comet (GL-RM1) KVM devices for potential exploitation attempts.
  • Implement compensating controls, such as limiting physical access to devices.
  • Monitor for and respond to potential exploitation attempts.

Evidence notes

The source item provided by CISA contains detailed information about the vulnerability, including its description, affected products, and remediation steps. The CVE record and NVD detail provide additional context and scoring information. Eclypsium's blog post discusses the broader implications of KVM vulnerabilities. The official fix is available from GL-iNet's website.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-32291 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-32291

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-32291 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-32291

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-076-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-076-01.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://eclypsium.com/blog/your-kvm-is-the-weak-link-how-30-dollar-devices-can-own-your-entire-network/

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://dl.gl-inet.com/release/kvm/release/RM1/1.8.2

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.