CVE-2026-32292

Name of the Vulnerable Software and Affected Versions GL-iNet Comet (GL-RM1) versions (affected versions not specified)

Description The web interface for the KVM feature in GL-iNet Comet (GL-RM1) does not restrict the number of login attempts. This allows attackers to perform brute-force attacks to compromise user credentials. Reports indicate that the device, a KVM box, could serve as a network pivot point for attackers using tools like Hydra.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.