CVE-2026-32293

The GL-iNet Comet (GL-RM1) KVM connects to a GL-iNet site during boot-up to provision client and CA certificates. The GL-RM1 does not verify certificates used for this connection, allowing an attacker-in-the-middle to serve invalid client and CA certificates. The GL-RM1 will attempt to use the invalid certificates and fail to connect to the legitimate GL-iNet KVM cloud service.

• CWE-295

• https://dl.gl-inet.com/release/kvm/release/RM1/1.7.2Release Notes
• https://eclypsium.com/blog/your-kvm-is-the-weak-link-how-30-dollar-devices-can-own-your-entire-network/Third Party Advisory
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-076-01.jsonBroken Link
• https://www.cve.org/CVERecord?id=CVE-2026-32293Third Party Advisory

Published

Mar 17, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32288tar.Reader can allocate an unbounded amount of memory when r…5.5
• CVE-2026-32289Context was not properly tracked across template branches fo…6.1
• CVE-2026-3229An integer overflow vulnerability existed in the static func…5.5
• CVE-2026-32290The GL-iNet Comet (GL-RM1) KVM before version 1.8.2 does not…7
• CVE-2026-32291The GL-iNet Comet (GL-RM1) KVM before 1.8.2 does not require…7
• CVE-2026-32292The GL-iNet Comet (GL-RM1) KVM web interface does not limit …9.3
• CVE-2026-32294JetKVM prior to 0.5.4 does not verify the authenticity of do…7
• CVE-2026-32295JetKVM before 0.5.4 does not rate limit login requests, enab…9.3
• CVE-2026-32296Sipeed NanoKVM before 2.3.1 exposes a Wi-Fi configuration en…8.8
• CVE-2026-32297The Angeet ES3 KVM allows a remote, unauthenticated attacker…9.3
• CVE-2026-32298The Angeet ES3 KVM does not properly sanitize user-supplied …9.1
• CVE-2026-32299Connect-CMS is a content management system. In versions on t…7.5