CVE-2026-32290 Details
Description
The GL-iNet Comet (GL-RM1) KVM before version 1.8.2 does not sufficiently verify the authenticity of uploaded firmware files. An attacker-in-the-middle or a compromised update server could modify the firmware and the corresponding MD5 hash to pass verification.
A vulnerability exists in the GL-iNet Comet KVM (model GL-RM1) due to inadequate verification of the authenticity of uploaded firmware files. This flaw allows an attacker-in-the-middle or a compromised update server to alter the firmware and its corresponding MD5 hash, enabling the modified firmware to pass verification. The lack of proper validation creates a significant security risk, as the device may accept tampered firmware as legitimate.
GL-iNet has no planned fix for this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 17, 2026CISA-ADP
Assessed Mar 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://dl.gl-inet.com/release/kvm/release/RM1/1.8.2 | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government | Release Notes |
| https://eclypsium.com/blog/your-kvm-is-the-weak-link-how-30-dollar-devices-can-own-your-entire-network/ | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government | Third Party Advisory |
| https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-076-01.json | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government | Broken Link |
| https://www.cve.org/CVERecord?id=CVE-2026-32290 | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government |
Affected Products
| Product | Versions |
|---|---|
| gl-inet comet gl-rm1 firmware | < 1.8.2 |
CPE
Remediation
| |
| gl-inet comet gl-rm1 | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | Initial Analysis | [email protected] |
| Mar 23, 2026 | CVE Modified | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government |
| Mar 17, 2026 | New CVE Received | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government |