GL-iNet Comet KVM EUVD-2026-12602

No special conditions required for exploitation - remote unauthenticated brute-force attacks succeed against default configurations of network-accessible Comet KVM web interfaces. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms network reachability is the only prerequisite, with no privileges, user interaction, or non-default configuration needed. Exploitation success depends solely on password strength: weak, default, or commonly-used credentials enable rapid compromise, while strong unique passwords significantly increase attack duration and detection likelihood. Deployment on internet-facing networks versus isolated management VLANs affects attacker accessibility but does not change the fundamental vulnerability - insider threats or attackers with management network access can exploit equally. The lack of rate limiting means brute-force attacks are limited only by network bandwidth and attacker resources, not by device-enforced controls.

Real-world risk assessment reveals conflicting signals requiring careful interpretation. The CVSS v4.0 score of 9.3 reflects catastrophic potential impact with cross-scope compromise (SC:H/SI:H/SA:H), indicating attackers gaining KVM access can pivot to connected servers with high confidentiality, integrity, and availability impact. However, EPSS score of 0.03% (8th percentile) suggests extremely low observed exploitation in the wild. This discrepancy likely reflects the device's niche deployment profile - while not widely deployed compared to enterprise infrastructure, KVMs control critical systems when present. The AV:N/AC:L/PR:N vector confirms trivial exploitation requirements: any network-reachable KVM can be targeted without authentication. No CISA KEV listing indicates no confirmed widespread exploitation campaigns. The primary risk materializes in targeted attacks against organizations using these devices in datacenters or remote infrastructure, where successful brute-force yields administrative console access to multiple servers. Eclypsium's public research raises awareness but no public exploit code is confirmed. Priority depends heavily on asset exposure: internet-facing KVMs represent critical risk requiring immediate patching; isolated management network deployments face lower but non-negligible insider threat risk.

An external attacker identifies a GL-iNet Comet KVM device exposed on the internet via port scanning (commonly TCP 80/443) and fingerprinting the distinctive web interface. Using automated brute-force tools like Hydra or Medusa with common credential lists (admin/admin, admin/password, default manufacturer credentials), the attacker submits thousands of login attempts without triggering lockouts or delays. After successfully guessing valid credentials-potentially within hours depending on password complexity-the attacker gains full administrative access to the KVM web console, enabling them to view live server console output, inject keystrokes to connected servers, mount virtual media for OS installation, and potentially pivot to compromise the entire rack of servers managed through the device.