CVE-2026-32292 in Comet KVM
Summary
by MITRE • 03/17/2026
The GL-iNet Comet (GL-RM1) KVM web interface does not limit login requests, enabling brute-force attempts to guess credentials.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 03/21/2026
The GL-iNet Comet GL-RM1 KVM web interface presents a critical authentication vulnerability that stems from the absence of rate limiting mechanisms for login attempts. This device operates as a remote management solution that allows administrators to access system interfaces through web-based protocols, making it a prime target for automated credential guessing attacks. The vulnerability manifests in the web interface's failure to implement any form of account lockout mechanism or request throttling, which creates an environment where malicious actors can systematically attempt to guess valid credentials without encountering any barriers. The device's architecture relies on standard web authentication protocols that are typically secured through proper rate limiting implementations, yet this specific model fails to incorporate such fundamental security controls.
This authentication flaw directly maps to CWE-307, which addresses "Improper Restriction of Excessive Authentication Attempts," and represents a significant weakness in the device's access control mechanisms. The vulnerability allows for unlimited login attempts without any form of temporary lockout or delay enforcement, creating an ideal environment for brute-force attacks that can systematically test password combinations against the target system. The web interface operates using standard HTTP protocols that are commonly used for remote management tasks, but the lack of authentication throttling means that attackers can leverage automated tools to rapidly cycle through common username and password combinations, potentially leading to successful unauthorized access. The absence of any form of session management or account protection mechanisms leaves the device vulnerable to credential stuffing attacks where attackers can leverage previously compromised credentials from other systems.
The operational impact of this vulnerability extends beyond simple unauthorized access, as it can enable attackers to gain full administrative control over the device's management functions. Once authenticated, attackers can potentially modify device configurations, access sensitive data, or even use the device as a pivot point to attack other systems within the network. The KVM interface allows for remote console access, which means that successful exploitation could provide attackers with complete control over the device's operations and potentially expose additional network resources. This vulnerability particularly affects environments where the device is exposed to untrusted networks or where default credentials are not changed, as it removes any barriers that would typically slow down or prevent automated attack attempts. The attack surface is further expanded because the device may be used in enterprise environments where management interfaces are not properly secured, creating opportunities for attackers to escalate privileges and gain access to critical infrastructure.
Mitigation strategies for this vulnerability should focus on implementing proper rate limiting mechanisms at the web server level, including account lockout policies that activate after a predetermined number of failed authentication attempts. Network administrators should ensure that default credentials are changed immediately upon device deployment and that strong, unique passwords are implemented for all administrative accounts. The device should be configured to enforce minimum password complexity requirements and regular credential rotation policies. Additionally, network segmentation should be implemented to isolate management interfaces from general network traffic, and multi-factor authentication should be enabled where possible. Security monitoring should be implemented to detect unusual authentication patterns that could indicate brute-force attack attempts, and access controls should be restricted to specific IP addresses or ranges to minimize exposure. The implementation of these controls aligns with ATT&CK technique T1110 which addresses credential access through brute force methods, and addresses the broader security principle of defense in depth that requires multiple layers of protection to be effective against various attack vectors.