GL-iNet Comet Firmware Verification

JetKVM versions prior to 0.5.4 lack cryptographic verification of firmware update authenticity, allowing attackers positioned on the network or controlling the update server to inject malicious firmware that bypasses hash validation. This enables local attackers with user interaction to compromise system integrity through a man-in-the-middle attack or server compromise. A patch is available to address this vulnerability.

Firmware update integrity checks in GL-iNet Comet (GL-RM1) KVM can be bypassed by attackers positioned on the network path or who have compromised the update server. The device relies solely on MD5 hash verification, which an attacker can recalculate after modifying the firmware image. Successful exploitation allows installation of malicious firmware, granting persistent control over the KVM device and potentially compromising all systems managed through it. EPSS score is minimal (0.01%), indicating low likelihood of mass exploitation, but CVSS 7.0 and specialized targeting of KVM infrastructure suggest high impact for targeted attacks. No public exploit code identified at time of analysis.