CVE-2026-32291
Unauthorized UART Access in GL-iNet Comet KVM Console
Publication date: 2026-03-17
Last updated on: 2026-04-27
Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gl-inet | comet_gl-rm1_firmware | to 1.8.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in the GL-iNet Comet (GL-RM1) KVM allows an attacker to access the UART serial console without any authentication.
To exploit this vulnerability, the attacker must physically open the device and connect to the UART pins.
How can this vulnerability impact me? :
Because the UART serial console does not require authentication, an attacker with physical access can gain high-level control over the device.
This can lead to complete compromise of confidentiality, integrity, and availability of the device.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves unauthorized access to the UART serial console of the GL-iNet Comet (GL-RM1) KVM device, which requires physical access to the device and connecting to the UART pins.
Because the attack requires physical interaction with the hardware, it cannot be detected through network commands or remote system scans.
No specific commands or network-based detection methods are available to identify this vulnerability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, restrict physical access to the GL-iNet Comet (GL-RM1) KVM device to trusted personnel only.
Ensure the device is kept in a secure location to prevent unauthorized opening and connection to the UART pins.
Consider implementing physical tamper-evident measures or enclosures to detect or deter unauthorized physical access.