A lack of authentication rate limiting in the GL-iNet Comet KVM web interface exposes the device to credential brute-forcing, risking unauthorized administrative access.

The device suffers from improper restriction of excessive authentication attempts (CWE-307), which allows an unauthenticated, remote attacker to repeatedly attempt to guess valid login credentials without being locked out.

The vulnerability carries a CVSS score of 7.5, indicating a high severity risk. Successful exploitation could grant an attacker unauthorized administrative control over the KVM device, potentially allowing them to intercept or manipulate traffic across the connected network, leading to severe data compromise and total loss of device confidentiality and integrity.

Immediate Action: Update the firmware of the GL-iNet Comet KVM device to version 1.7.2 or later to enforce proper authentication rate limiting.

Proactive Monitoring: Review web interface access logs for excessive login attempts or multiple failed authentication events originating from a single IP address.

Compensating Controls: Deploy a Web Application Firewall or restrict access to the KVM management interface using network-level controls, such as VPN requirements or IP allowlisting, to prevent direct exposure to the public internet.

Public Exploit Available: Unknown

Given the high severity of this vulnerability, administrators should prioritize updating affected KVM devices to version 1.7.2 immediately. Because KVM devices often provide deep access to network infrastructure, leaving this authentication flaw unpatched poses an unacceptable risk to the entire internal network environment.