Comet Kvm
Monthly
The GL-iNet Comet (GL-RM1) KVM connects to a GL-iNet site during boot-up to provision client and CA certificates.
Unrestricted authentication brute-forcing in GL-iNet Comet (GL-RM1) KVM web interface allows remote unauthenticated attackers to compromise device credentials and potentially pivot to connected systems. The web interface lacks rate limiting or account lockout mechanisms on login attempts, enabling dictionary and credential stuffing attacks against the network-accessible management console. EPSS score of 0.03% indicates low observed exploitation probability, though the 9.3 CVSS v4.0 reflects severe potential impact with cross-scope confidentiality and integrity compromise to subsequent systems. Vendor patch version 1.7.2 addresses the vulnerability per CISA advisory VA-26-076-01.
Physical UART access on GL-iNet Comet (GL-RM1) KVM grants unauthenticated attackers complete device control with high confidentiality, integrity, and availability impact. This hardware-level authentication bypass (CWE-306) requires disassembling the device and connecting to internal serial pins, significantly limiting practical exploitation despite the 7.0 CVSS score. EPSS probability is very low (0.03%, 7th percentile), consistent with the physical access requirement. No active exploitation confirmed; CISA CG reported this vulnerability alongside vendor firmware version 1.8.2 reference, suggesting patch availability.
Firmware update integrity checks in GL-iNet Comet (GL-RM1) KVM can be bypassed by attackers positioned on the network path or who have compromised the update server. The device relies solely on MD5 hash verification, which an attacker can recalculate after modifying the firmware image. Successful exploitation allows installation of malicious firmware, granting persistent control over the KVM device and potentially compromising all systems managed through it. EPSS score is minimal (0.01%), indicating low likelihood of mass exploitation, but CVSS 7.0 and specialized targeting of KVM infrastructure suggest high impact for targeted attacks. No public exploit code identified at time of analysis.
The GL-iNet Comet (GL-RM1) KVM connects to a GL-iNet site during boot-up to provision client and CA certificates.
Unrestricted authentication brute-forcing in GL-iNet Comet (GL-RM1) KVM web interface allows remote unauthenticated attackers to compromise device credentials and potentially pivot to connected systems. The web interface lacks rate limiting or account lockout mechanisms on login attempts, enabling dictionary and credential stuffing attacks against the network-accessible management console. EPSS score of 0.03% indicates low observed exploitation probability, though the 9.3 CVSS v4.0 reflects severe potential impact with cross-scope confidentiality and integrity compromise to subsequent systems. Vendor patch version 1.7.2 addresses the vulnerability per CISA advisory VA-26-076-01.
Physical UART access on GL-iNet Comet (GL-RM1) KVM grants unauthenticated attackers complete device control with high confidentiality, integrity, and availability impact. This hardware-level authentication bypass (CWE-306) requires disassembling the device and connecting to internal serial pins, significantly limiting practical exploitation despite the 7.0 CVSS score. EPSS probability is very low (0.03%, 7th percentile), consistent with the physical access requirement. No active exploitation confirmed; CISA CG reported this vulnerability alongside vendor firmware version 1.8.2 reference, suggesting patch availability.
Firmware update integrity checks in GL-iNet Comet (GL-RM1) KVM can be bypassed by attackers positioned on the network path or who have compromised the update server. The device relies solely on MD5 hash verification, which an attacker can recalculate after modifying the firmware image. Successful exploitation allows installation of malicious firmware, granting persistent control over the KVM device and potentially compromising all systems managed through it. EPSS score is minimal (0.01%), indicating low likelihood of mass exploitation, but CVSS 7.0 and specialized targeting of KVM infrastructure suggest high impact for targeted attacks. No public exploit code identified at time of analysis.