Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The GL-iNet Comet (GL-RM1) KVM web interface does not limit login requests, enabling brute-force attempts to guess credentials.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 2 products
CVE-2026-32292 The GL-iNet Comet (GL-RM1) KVM web interface does not limit login requests, enabling brute-force attempts to guess credentials. https://www.cve.org/CVERecord?id=CVE-2026-32292
Post summary
CVE-2026-32292 reveals that the GL‑iNet Comet’s KVM web interface does not throttle login requests, making it vulnerable to brute‑force credential guessing.
CVE-2026-32292 Unauthenticated Brute-Force Vulnerability in GL-iNet Comet KVM Web Interface https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-32292
Post summary
The post announces CVE‑2026‑32292 as an unauthenticated brute‑force issue in the GL‑iNet Comet KVM web interface, without providing PoC code, exploit details, or remediation information.
🚨 CVE-2026-32292: GL-iNet Comet... $30 KVM boxes with zero rate limiting = instant network pivot point for anyone with Hydra and patience. #KVMpwn #BruteForce #NetworkPivot. https://zerodaysignal.com/vulnerability/CVE-2026-32292 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The post announces CVE-2026-32292, noting that GL‑iNet Comet KVM boxes lack rate limiting and could become pivot points when combined with brute‑force tools, but it offers no detailed exploit, patch, or evidence of active attacks.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | gl-inet | comet_gl-rm1 | - | - | - |
| OS | gl-inet | comet_gl-rm1_firmware | - | - | - |