GL-iNet Comet KVM CVE-2026-32290

Upgrade GL-iNet Comet KVM firmware to version 1.8.2 or later, available from https://dl.gl-inet.com/release/kvm/release/RM1/1.8.2, which presumably implements cryptographic signature verification rather than hash-only validation. Consult CISA CSAF advisory VA-26-076-01 for additional guidance. Until patching is complete, implement network-level compensating controls: isolate KVM devices on dedicated management VLANs unreachable from general network segments, configure firewall rules to restrict firmware update traffic to known-good GL-iNet update server IP addresses with TLS inspection enabled, and disable automatic firmware updates in favor of manual updates downloaded over verified HTTPS connections and transferred via trusted USB media. Consider deploying network intrusion detection signatures to alert on unexpected firmware download activity from KVM device IP addresses. For high-security environments, evaluate replacing affected devices with KVMs that support cryptographically signed firmware, as retrofitting strong authentication into existing update infrastructure may not be feasible. Note that network isolation reduces attack surface but increases operational overhead for legitimate updates and does not protect against compromised update servers, only opportunistic MITM attacks.