Which versions of GL-iNet Comet KVM are affected by EUVD-2026-12602?

GL-iNet Comet (GL-RM1) KVM web interface contains an unauthenticated brute-force vulnerability (CVE-2026-32292, CVSS 9.3) that allows attackers to compromise device credentials without rate limiting…. A patch is available.

How to fix or mitigate EUVD-2026-12602?

Within 24 hours: Inventory all GL-iNet Comet (GL-RM1) devices and restrict web interface access to trusted IP ranges via firewall rules. Within 7 days: Apply vendor patch version 1.7.2 to all affected devices per CISA advisory VA-26-076-01. Within 30 days: Implement network segmentation isolating KVM management interfaces, enforce multi-factor authentication on device accounts, and conduct credential rotation for all management accounts on affected devices.

GL-iNet Comet KVM EUVD-2026-12602

Q: What is the CVSS score of EUVD-2026-12602?

EUVD-2026-12602 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-32292 CRITICAL

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-03-17 cisa-cg

Information Disclosure Comet Kvm

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 27, 2026 - 12:57 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 27, 2026 - 12:52 vuln.today

cvss_changed

Severity Changed

Apr 27, 2026 - 12:52 NVD

HIGH CRITICAL

CVSS changed

Apr 27, 2026 - 12:52 NVD

7.5 (HIGH) 9.3 (CRITICAL)

Analysis Updated

Apr 16, 2026 - 06:21 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.7.2

EUVD ID Assigned

Mar 17, 2026 - 20:30 euvd

EUVD-2026-12602

Analysis Generated

Mar 17, 2026 - 20:30 vuln.today

CVE Published

Mar 17, 2026 - 17:18 nvd

HIGH 7.5

DescriptionCVE.org

The GL-iNet Comet (GL-RM1) KVM web interface does not limit login requests, enabling brute-force attempts to guess credentials.

AnalysisAI

Unrestricted authentication brute-forcing in GL-iNet Comet (GL-RM1) KVM web interface allows remote unauthenticated attackers to compromise device credentials and potentially pivot to connected systems. The web interface lacks rate limiting or account lockout mechanisms on login attempts, enabling dictionary and credential stuffing attacks against the network-accessible management console. EPSS score of 0.03% indicates low observed exploitation probability, though the 9.3 CVSS v4.0 reflects severe potential impact with cross-scope confidentiality and integrity compromise to subsequent systems. Vendor patch version 1.7.2 addresses the vulnerability per CISA advisory VA-26-076-01.

Technical ContextAI

The GL-iNet Comet (GL-RM1) is a network-attached KVM-over-IP device enabling remote server console access. The vulnerability (CWE-307: Improper Restriction of Excessive Authentication Attempts) exists in the device's HTTP/HTTPS web management interface, which exposes authentication endpoints without implementing account lockout policies, progressive delays, CAPTCHA, or IP-based rate limiting. The CVSS v4.0 vector indicates network attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), and critically shows cross-scope impact (SC:H/SI:H/SA:H), meaning compromise extends beyond the KVM device itself to connected infrastructure. Per CPE 2.3 identifier, all Comet KVM firmware versions prior to 1.7.2 are affected. As documented in Eclypsium's research, these budget KVM devices often operate with administrative access to critical servers, making credential compromise a high-value target for lateral movement and supply chain attacks.

RemediationAI

Upgrade all GL-iNet Comet KVM devices to firmware version 1.7.2 or later, available from https://dl.gl-inet.com/release/kvm/release/RM1/1.7.2 per vendor release and CISA advisory VA-26-076-01. Firmware update process typically requires administrative console access and may cause brief service interruption during reboot. If immediate patching is not feasible, implement network-layer compensating controls: restrict KVM web interface access to dedicated management VLANs with strict firewall rules permitting only authorized administrator source IPs (note this reduces remote access flexibility which may be operationally unacceptable for distributed infrastructure). Deploy intrusion detection signatures to alert on excessive failed authentication attempts from single source IPs (threshold recommendation: 10+ failures in 5 minutes). Enforce strong credential policies including 16+ character passwords and unique credentials per device to increase brute-force attack cost. As temporary mitigation, consider placing KVMs behind VPN or zero-trust network access gateway requiring MFA before reaching device login page, though this adds architectural complexity. Verify patch installation by confirming firmware version in web interface and testing that repeated login failures now trigger rate limiting or temporary account lockout.