Gl Rm1 EUVD-2026-20928

Requires high-privilege authentication (PR:H) and high attack complexity (AC:H) against GL.iNet GL-RM1, GL-RM10, GL-RM10RC, or GL-RM1PE running firmware version 1.8.1. Attacker must manipulate Factory Reset Handler functionality remotely. Exploitation is difficult and requires authenticated access.

The CVSS 3.1 score of 6.6 (medium-high) with vector AV:N/AC:H/PR:H reflects a network-accessible vulnerability requiring high privileges and high attack complexity, resulting in high confidentiality, integrity, and availability impact. The PR:H (Privileges Required: High) qualifier significantly constrains real-world exploitability-an attacker must already possess authenticated administrator-level access to the device. The AC:H (Attack Complexity: High) further indicates exploitation difficulty. However, the authentication bypass designation and confirmed patch availability suggest the vulnerability posed genuine risk in specific deployment scenarios where compromised or rogue administrators could escalate or misuse their access. The absence of KEV (CISA Known Exploited Vulnerabilities) status and no public POC evidence at analysis time indicate this is not an active exploitation target in broader threat landscapes, despite the vendor's acknowledgment and rapid patching response. For GL.iNet customers, patch availability and vendor responsiveness mitigate organizational risk if update deployment processes are functioning.

An authenticated administrator or privileged remote user with existing high-level access to a GL.iNet GL-RM appliance manipulates the Factory Reset Handler component during a remote management session, exploiting the improper authentication logic to bypass intended access controls and reset or reconfigure device security settings without full authorization chain validation. Due to the high attack complexity and privilege requirement, exploitation is most plausible in scenarios involving compromised or rogue administrative credentials, insider threats, or lateral movement by an attacker already present on the management network. No public POC has been identified; the vulnerability's discovery and vendor response occurred through responsible disclosure.