GL-iNet Comet KVM Brute-Force Vulnerability

A vulnerability exists in the GL-iNet Comet KVM web interface on the GL-RM1 model, where the login process lacks any rate limiting. This absence allows for brute-force attacks to be conducted, enabling attackers to rapidly guess credentials. Additionally, the same password used for the web interface login is applied to SSH access by default, creating an easier pathway for exploitation.

Impact

Exploitation of this vulnerability allows for brute-force attacks on the KVM web interface login, with no restrictions on the number of login attempts. This could lead to unauthorized access via SSH, as the same credentials are used for both the web interface and SSH access by default.

Remediation

Users can update to GL-iNet Comet KVM version 1.8.1 BETA, which includes a fix for the brute-force vulnerability by implementing IP banning after 10 consecutive failed login attempts.