CVE-2026-32293

Name of the Vulnerable Software and Affected Versions GL-iNet Comet (GL-RM1) KVM (affected versions not specified)

Description The GL-iNet Comet (GL-RM1) KVM connects to a GL-iNet site during startup to obtain client and CA certificates. The device does not validate the certificates used during this connection, which allows a malicious actor positioned between the device and the GL-iNet site to provide invalid client and CA certificates. The GL-RM1 will attempt to utilize these invalid certificates, resulting in a failure to connect to the legitimate GL-iNet KVM cloud service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.