CVE-2026-32293 | BDVDB-2026-320921 Detail

Description#

The GL-iNet Comet (GL-RM1) KVM connects to a GL-iNet site during boot-up to provision client and CA certificates. The GL-RM1 does not verify certificates used for this connection, allowing an attacker-in-the-middle to serve invalid client and CA certificates. The GL-RM1 will attempt to use the invalid certificates and fail to connect to the legitimate GL-iNet KVM cloud service.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-03-17Record published in the CVE List.
2. Version 22026-03-23Most recent update recorded in the CVE List.