The vulnerability exists in GL‑iNet Comet KVM firmware versions earlier than 1.8.2. The UART serial console does not enforce authentication, allowing anyone with physical access to the device to log in as root. This bypass of required authentication (CWE‑306) means an attacker could obtain complete control of the device, modify configuration, exfiltrate data, or pivot to other devices on the network.

Affected products are the GL‑iNet Comet KVM, model GL‑RM1. All firmware releases prior to 1.8.2 are vulnerable. Users of devices running those firmware versions must verify the firmware and update if possible.

The CVSS score of 7 indicates a high severity vulnerability. The EPSS score of less than 1% reflects a low likelihood of exploitation in the wild, and the vulnerability is not included in the CISA KEV catalog. Exploitation requires physical access to connect to the UART pins, which limits the attack surface. Nevertheless, devices deployed in environments where attackers could gain physical access pose a significant risk.