GL-iNet Comet KVM CVE-2026-32291

Physical access to the GL-iNet Comet GL-RM1 device sufficient to open the enclosure and connect debugging equipment to internal UART circuit board pins. Requires attacker capability to identify UART pin locations (typically labeled TX, RX, GND on PCB), appropriate hardware tools (USB-to-serial adapter with 3.3V or 5V logic levels matching device specifications), and terminal software configured for UART communication parameters. Typical prerequisites include screwdrivers to open device case, basic electronics knowledge to avoid damaging circuitry, and physical presence duration of 5-15 minutes for initial access. Limits to exploitation: strong physical security controls (locked racks, access control systems, video surveillance) significantly reduce attack feasibility. Remote exploitation is impossible (AV:P). The no privilege requirement (PR:N) and low attack complexity (AC:L) apply only after physical access is achieved-the physical barrier itself represents the primary defense. Environments with robust physical security, tamper detection, or continuous monitoring make this attack impractical despite the technical ease once physical access is obtained.

Real-world risk is significantly lower than the 7.0 CVSS suggests due to the physical attack vector (AV:P). An attacker must physically open the device enclosure, identify and access internal UART pins, and connect debugging equipment-requiring hardware skills, tools, and sustained physical access to the device. The CVSS vector shows AV:P/AC:L/PR:N with high impact across confidentiality, integrity, and availability, but the physical prerequisite creates a natural barrier absent in network-based vulnerabilities. EPSS score of 0.03% (7th percentile) confirms minimal real-world exploitation likelihood, as automated or remote mass exploitation is impossible. No CISA KEV listing indicates no confirmed active exploitation. The CISA CG advisory and Eclypsium research report position this within broader KVM security concerns, suggesting targeted research interest rather than widespread attacker activity. Primary risk scenarios involve supply chain interdiction, malicious insiders with physical access, or sophisticated adversaries targeting high-value isolated networks where KVMs bridge air-gapped systems. For typical enterprise deployments with physical security controls, this ranks below remotely exploitable vulnerabilities. Organizations using these KVMs in sensitive environments (data centers, secure facilities, industrial control systems) should prioritize remediation; those with robust physical security can deprioritize relative to network-accessible threats.

An attacker with physical access to a data center, server room, or office opens the GL-iNet Comet KVM enclosure using basic tools. They locate the UART pins on the circuit board, connect a USB-to-serial adapter and laptop running terminal software (such as screen, minicom, or PuTTY). Upon establishing the UART connection, they gain unauthenticated root-level console access to the device firmware. From this position, they can extract credentials for connected systems, modify KVM firmware to intercept keystrokes and video data from all managed servers, or reconfigure the device to establish persistence and enable remote access. The compromised KVM becomes a covert pivot point for accessing multiple high-value systems without triggering network-based detection.