PT-2026-25912 · Gl.Inet · Gl-Inet Comet (Gl-Rm1) Kvm

Reynaldo Vasquez Garcia · Publicado 2026-03-17 · Atualizado 2026-04-27 · CVE-2026-32290

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Média

Vetor base

AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions GL-iNet Comet (GL-RM1) KVM versions prior to 1.8.2

Description The GL-iNet Comet (GL-RM1) KVM does not properly confirm the legitimacy of firmware files during upload. This allows an attacker positioned between the user and the update server, or one who has gained control of the update server, to alter the firmware and its MD5 hash, enabling the modified firmware to pass verification.

Recommendations Update to version 1.8.2 or later.

Correção

Insufficient Verification of Data Authenticity

Enumeração de Fraquezas

CWE-345

Identificadores relacionados

CVE-2026-32290

Produtos afetados

Gl-Inet Comet (Gl-Rm1) Kvm

Referências · 9

• https://t.me/cveNotify/161059 · Publicação no Telegram
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-076-01.json · Nota
• https://dl.gl-inet.com/release/kvm/release/RM1/1.8.2 · Correção
• https://cve.org/CVERecord?id=CVE-2026-32290 · Nota de Segurança
• https://twitter.com/reni_ni/status/2034202223689793827 · Publicação no Twitter
• https://eclypsium.com/blog/your-kvm-is-the-weak-link-how-30-dollar-devices-can-own-your-entire-network · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-32290 · Nota de Segurança
• https://t.me/true_secator/8008 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2033994268201914814 · Publicação no Twitter