CVE-2026-32291: Gl-Inet Comet Gl-RM1 Firmware

Medium severity, CVSS 6.8. EPSS: 0.3% chance of exploitation in the next 30 days.

The GL-iNet Comet (GL-RM1) KVM before 1.8.2 does not require authentication on the UART serial console. This attack requires physically opening the device and connecting to the UART pins.

Affected products

• Gl-Inet Comet Gl-RM1 Firmware: before 1.8.2 (fixed in 1.8.2)

Published 2026-03-17. Last modified 2026-06-17.