GL-iNet Comet KVM EUVD-2026-12598

Exploitation requires the attacker to be positioned on the network path between the GL-iNet Comet KVM device and the firmware update server during a firmware update operation, OR requires prior compromise of GL-iNet's update distribution infrastructure. The administrator must initiate or approve a firmware update (UI:A in CVSS vector). The vulnerability cannot be exploited remotely without network positioning or server compromise - default configurations are vulnerable, but the attack timing depends on when updates occur. Limiting factors include: update checks may be infrequent (reducing exposure window), some deployments may use air-gapped or isolated management networks (preventing MITM), and organizations with strict change management may manually verify firmware sources through out-of-band channels. The AT:P (Attack Requirements: Present) metric confirms that specific conditions beyond attacker control must align for successful exploitation.

Real-world risk assessment reveals moderate-to-high priority for organizations using affected KVM devices in sensitive environments, despite low EPSS score. The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:A) indicates local attack vector with low complexity but requiring present attack conditions and user action, yet the scope change metrics (SC:H/SI:H/SA:H) show high impact across confidentiality, integrity, and availability when scope is changed. This apparent contradiction between local vector and the described man-in-the-middle scenario suggests the CVSS vector may refer to the firmware installation phase (local) while the description addresses the delivery phase (network). EPSS 0.01% indicates automated scanning tools are not actively exploiting this, consistent with a targeted infrastructure attack requiring specific positioning. The CVSS:4.0 AT:P (Attack Requirements: Present) modifier is critical - this is not trivial remote exploitation but requires either network position during update checks or prior compromise of update infrastructure. For organizations using these KVMs to manage sensitive systems, the consequence of compromise is severe: attackers gain persistent visibility and control over all managed endpoints, can intercept credentials, and survive system reimaging. The Eclypsium research publication suggests this was discovered during security analysis of low-cost KVM devices, not from incident response, reducing urgency but not impact. Priority should be elevated for environments where KVMs manage critical infrastructure, financial systems, or classified networks.

An attacker with network position between the GL-iNet Comet KVM and the firmware update server (e.g., compromised network infrastructure, rogue Wi-Fi access point, or ARP spoofing on the management network) intercepts the device's firmware update request. The attacker replaces the legitimate firmware image with a modified version containing backdoor code that logs all keystrokes and screen content, then recalculates the MD5 hash for the malicious firmware. The KVM device downloads the tampered firmware, validates the attacker-supplied MD5 hash successfully, and prompts the administrator to install the update. Once installed, the attacker gains persistent access to all credentials and data passing through the KVM, affecting every system managed by the device.