CVE-2026-32291 in Comet KVM
Summary
by MITRE • 03/17/2026
The GL-iNet Comet (GL-RM1) KVM before 1.8.2 does not require authentication on the UART serial console. This attack requires physically opening the device and connecting to the UART pins.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 03/23/2026
The vulnerability identified as CVE-2026-32291 affects the GL-iNet Comet (GL-RM1) KVM firmware version 1.8.2 and earlier, presenting a critical security weakness in the device's serial console access controls. This issue represents a fundamental failure in the device's authentication mechanisms, where the UART serial console operates without any form of authentication requirements. The vulnerability is particularly concerning because it can be exploited by an attacker who has physical access to the device, making it a significant concern for embedded systems security where physical access controls are often assumed to be sufficient.
The technical flaw stems from the absence of authentication checks on the UART serial console interface, which is a direct violation of standard security practices for embedded systems. When an attacker physically opens the device and connects to the UART pins, they gain immediate access to the system console without needing to provide any credentials or authentication tokens. This represents a classic case of insufficient authentication, which maps directly to CWE-287 - "Improper Authentication" within the CWE taxonomy. The vulnerability's exploitation requires physical access to the device, making it a privilege escalation issue rather than a network-based attack vector, but this does not diminish its severity in environments where physical security is inadequate.
The operational impact of this vulnerability is substantial, particularly in environments where physical security is not properly maintained or where devices are deployed in accessible locations. An attacker with physical access could potentially gain root access to the device, allowing them to modify firmware, extract sensitive data, install malicious software, or use the device as a pivot point for attacks on other networked systems. The vulnerability is especially problematic in industrial environments, IoT deployments, or any scenario where devices are not properly secured against physical tampering. This aligns with ATT&CK technique T1014 - "Rootkit" and T1059 - "Command and Scripting Interpreter" as attackers could leverage the unauthenticated console access to execute arbitrary commands and establish persistent access to the system.
The remediation for this vulnerability requires firmware updates to implement proper authentication mechanisms on the UART serial console. Device manufacturers should ensure that all console interfaces require appropriate authentication before granting access to system-level functions. This includes implementing strong authentication protocols, enforcing access controls, and ensuring that physical access to the device does not automatically grant administrative privileges. Organizations should also implement proper physical security measures, including tamper-evident seals, secure device housing, and access controls to prevent unauthorized physical access to critical network equipment. Additionally, system administrators should regularly audit device configurations and ensure that unnecessary services or interfaces are disabled to minimize attack surfaces. The vulnerability highlights the importance of applying the principle of least privilege even to physical interfaces, ensuring that access to system consoles is properly controlled and monitored.