CVE-2026-32291

Katalog CVE

CVSS 6.8 · Medium EPSS 0,34%

Kerentanan Missing Authentication for Critical Function pada gl-inet comet gl-rm1 firmware. Skor CVSS 3.1 6.8 (Medium) menurut CNA.

Deskripsi (NVD)

The GL-iNet Comet (GL-RM1) KVM before 1.8.2 does not require authentication on the UART serial console. This attack requires physically opening the device and connecting to the UART pins.

Rincian

Terbit di NVD

17 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.8 (Medium), sumber CNA
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 26,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://eclypsium.com/blog/your-kvm-is-the-weak-link-how-30-dollar-devices-can-own-your-entire-network/ advisory pihak ketiga
• https://www.cve.org/CVERecord?id=CVE-2026-32291 advisory pihak ketiga
• https://dl.gl-inet.com/release/kvm/release/RM1/1.8.2 release notes
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-076-01.json broken link