CVE-2026-32293 in Comet KVM
Summary
by MITRE • 03/17/2026
The GL-iNet Comet (GL-RM1) KVM connects to a GL-iNet site during boot-up to provision client and CA certificates. The GL-RM1 does not verify certificates used for this connection, allowing an attacker-in-the-middle to serve invalid client and CA certificates. The GL-RM1 will attempt to use the invalid certificates and fail to connect to the legitimate GL-iNet KVM cloud service.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 03/21/2026
The GL-iNet Comet (GL-RM1) KVM device presents a critical security vulnerability in its certificate validation mechanism during the boot process. This device establishes a connection to the GL-iNet site to provision client and CA certificates, a process that occurs automatically during system initialization. The vulnerability stems from the device's failure to implement proper certificate verification procedures, creating an exploitable gap in the secure communication chain. This flaw allows an attacker positioned in the network path between the device and the provisioning server to perform a man-in-the-middle attack by presenting malicious certificates that the device will accept without validation.
The technical implementation of this vulnerability aligns with CWE-295, which addresses improper certificate validation in secure communications. The GL-RM1 device demonstrates a failure in certificate pinning and validation processes that should occur during the initial provisioning phase. When the device receives certificates from the remote server, it lacks cryptographic verification mechanisms to ensure the authenticity and integrity of the presented certificates. This weakness creates a trust boundary failure where the device blindly accepts certificates without performing the necessary checks that would normally validate the certificate authority and the certificate's legitimacy.
The operational impact of this vulnerability extends beyond simple authentication failure, creating a potential pathway for complete system compromise and unauthorized access to the KVM service. An attacker who successfully executes this attack can intercept and manipulate the certificate provisioning process, potentially gaining access to the legitimate GL-iNet KVM cloud service or redirecting the device to malicious infrastructure. The device's subsequent failure to connect to the legitimate cloud service represents a denial-of-service condition that could disrupt critical remote management operations while simultaneously allowing the attacker to establish unauthorized communication channels. This vulnerability particularly affects environments where remote access and management are critical components of the security infrastructure.
From an ATT&CK framework perspective, this vulnerability maps to techniques involving credential access through man-in-the-middle attacks and privilege escalation via compromised authentication mechanisms. The attack requires network access and the ability to intercept traffic between the device and the provisioning server, which aligns with ATT&CK technique T1046 for network service scanning and T1566 for credential harvesting through social engineering or network interception. Organizations should implement network segmentation and traffic monitoring to detect anomalous certificate exchange patterns, while also ensuring that all devices in the supply chain maintain proper certificate validation procedures. The recommended mitigations include implementing certificate pinning mechanisms, enforcing strict certificate validation policies, and deploying network monitoring solutions that can detect unauthorized certificate exchanges during device boot processes.
The broader implications of this vulnerability highlight the importance of certificate validation in embedded systems and IoT devices where secure boot processes are critical. Device manufacturers must ensure that all communication channels during the provisioning phase implement robust certificate validation to prevent attackers from compromising the device's security posture. This vulnerability demonstrates the critical need for proper cryptographic implementation in network appliances and the potential consequences when such implementations are incomplete or absent. The attack scenario presents a clear path for attackers to establish persistent access points through the device's legitimate provisioning mechanism, making this a particularly concerning vulnerability for organizations relying on GL-iNet devices for remote management and security operations.