CVE-2026-32290 in Comet KVM
Summary
by MITRE • 03/17/2026
The GL-iNet Comet (GL-RM1) KVM before version 1.8.2 does not sufficiently verify the authenticity of uploaded firmware files. An attacker-in-the-middle or a compromised update server could modify the firmware and the corresponding MD5 hash to pass verification.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 03/23/2026
The GL-iNet Comet GL-RM1 KVM device represents a critical security vulnerability in the firmware update mechanism that undermines the integrity of the device's software ecosystem. This vulnerability exists within the firmware verification process that occurs during system updates, specifically failing to properly validate the authenticity of firmware images before installation. The device operates under the assumption that firmware updates received from trusted sources are legitimate, without implementing robust cryptographic verification mechanisms that would detect tampered or malicious firmware modifications. The vulnerability manifests when the device's update process accepts modified firmware files that have been altered by an attacker-in-the-middle or a compromised update server. The attacker can manipulate both the firmware binary and its corresponding MD5 hash, creating a false sense of security for the device's integrity. This flaw directly violates the principle of secure boot and firmware integrity verification that is fundamental to device security, as the system cannot distinguish between legitimate updates and maliciously modified versions.
The technical implementation of this vulnerability stems from the device's reliance on MD5 hash verification as the sole mechanism for ensuring firmware authenticity. MD5, while once considered sufficient for checksum verification, has known weaknesses that make it vulnerable to collision attacks and manipulation by sophisticated adversaries. The KVM firmware update process fails to implement proper cryptographic signatures or digital certificates that would be required to validate the firmware's origin and integrity. This creates a scenario where an attacker with access to the update channel can substitute a malicious firmware image with a legitimate-looking one, while simultaneously updating the MD5 hash to match the modified content. The vulnerability operates at the transport layer of the update process, where network-based attacks can intercept and modify both the firmware payload and its verification metadata. This flaw represents a classic case of insufficient input validation and authentication, as defined by CWE-22 and CWE-347, where the system fails to properly verify the source and integrity of critical system components.
The operational impact of this vulnerability extends far beyond the individual device, potentially enabling widespread compromise of GL-iNet Comet GL-RM1 devices within network environments. An attacker who successfully exploits this vulnerability can install malicious firmware that could persistently compromise the device's functionality, potentially creating backdoors, disabling security features, or redirecting network traffic through malicious proxies. The compromised device could then serve as a pivot point for further attacks within the network, as the KVM device typically provides critical remote access and management capabilities. This vulnerability aligns with ATT&CK technique T1068 which describes the use of legitimate credentials to gain access to systems, and T1547 which covers the persistence mechanisms that can be established through compromised firmware. The device's role in network management and remote access makes it a particularly attractive target for attackers seeking to establish long-term presence within enterprise environments.
Mitigation strategies for this vulnerability must address both the immediate security gap and the underlying architectural weaknesses in the firmware update mechanism. The most effective approach involves implementing robust cryptographic verification mechanisms that replace the vulnerable MD5-based system with strong cryptographic signatures using RSA or ECDSA algorithms. Device manufacturers should implement certificate-based authentication for firmware updates, ensuring that only firmware signed by authorized entities can be installed on the device. Network-level protections such as secure update channels and certificate pinning should be implemented to prevent man-in-the-middle attacks during the update process. Organizations should also implement firmware integrity monitoring systems that can detect unauthorized modifications to device configurations and operating parameters. The vulnerability highlights the importance of following security standards such as those outlined in NIST SP 800-147 for firmware security and ISO/IEC 27031 for information security in network infrastructure. Additionally, regular firmware update processes should include verification steps that ensure the integrity of the update mechanism itself, preventing attackers from compromising the update process as a whole. The implementation of these security measures aligns with ATT&CK technique T1566 which focuses on the development of malicious code for network infrastructure, and emphasizes the need for layered security approaches that protect against multiple attack vectors.