https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-32293.htmlhttps://patchthecve.com/cve/CVE-2026-32293.htmlWed, 17 Jun 2026 10:35:30 +0000LOW 3.7: The GL-iNet Comet (GL-RM1) KVM connects to a GL-iNet site during boot-up to provision client and CA certificates. The GL-RM1 does not verify certificates used for this connection, allowing an attacker-in-the-middle to serve invalid client and CA certificates. The GL-RM1 will attempt to use the invalhttps://patchthecve.com/cve/CVE-2026-32292.htmlhttps://patchthecve.com/cve/CVE-2026-32292.htmlWed, 17 Jun 2026 10:35:30 +0000HIGH 7.5: The GL-iNet Comet (GL-RM1) KVM web interface does not limit login requests, enabling brute-force attempts to guess credentials.https://patchthecve.com/cve/CVE-2026-32291.htmlhttps://patchthecve.com/cve/CVE-2026-32291.htmlWed, 17 Jun 2026 10:35:30 +0000MEDIUM 6.8: The GL-iNet Comet (GL-RM1) KVM before 1.8.2 does not require authentication on the UART serial console. This attack requires physically opening the device and connecting to the UART pins.https://patchthecve.com/cve/CVE-2026-32290.htmlhttps://patchthecve.com/cve/CVE-2026-32290.htmlWed, 17 Jun 2026 10:35:30 +0000MEDIUM 4.7: The GL-iNet Comet (GL-RM1) KVM before version 1.8.2 does not sufficiently verify the authenticity of uploaded firmware files. An attacker-in-the-middle or a compromised update server could modify the firmware and the corresponding MD5 hash to pass verification.