CVE-2026-32291

The GL-iNet Comet (GL-RM1) KVM before 1.8.2 does not require authentication on the UART serial console. This attack requires physically opening the device and connecting to the UART pins.

More information : https://dl.gl-inet.com/release/kvm/release/RM1/1.8.2