The GL‑iNet Comet (GL‑RM1) router’s KVM web interface permits unlimited login attempts, enabling an attacker to brute‑force credentials. This flaw, classified as CWE‑307, allows unauthorized individuals to discover the administrator password and gain full control of the device’s management functions. The impact is a complete compromise of account integrity, potentially allowing system configuration changes, traffic manipulation, or further lateral movement within the network.

All GL‑iNet Comet (GL‑RM1) devices that include the KVM web interface are affected. No specific firmware revision is listed, indicating that every build with the KVM feature remains susceptible until a mitigation is applied.

The vulnerability has a CVSS score of 9.3, which marks it as critical severity. EPSS data is not available and the issue is not currently cataloged in CISA’s Known Exploit Vulnerabilities list. The attack requires only remote reachability of the KVM interface; no local access or privileged execution is needed. If default or weak credentials are present, a brute‑force attack could succeed within a relatively short time. While no public exploits have been reported, the simplicity of the attack vector makes exploitation highly likely for motivated adversaries.