CVE-2026-5959: GL.iNet Router Auth Bypass Vulnerability

CVE-2026-5959 Overview

A security flaw has been discovered in GL.iNet KVM devices including GL-RM1, GL-RM10, GL-RM10RC, and GL-RM1PE running firmware version 1.8.1. This vulnerability affects the Factory Reset Handler component, allowing attackers to bypass authentication mechanisms after a factory reset is performed. The vulnerability enables remote access without proper authentication, though the attack complexity is high and exploitation is considered difficult.

Critical Impact

Remote authentication bypass allows unauthorized access to GL.iNet KVM devices, potentially enabling attackers to gain full control over affected systems and connected infrastructure.

Affected Products

• GL.iNet GL-RM1 firmware version 1.8.1
• GL.iNet GL-RM10 firmware version 1.8.1
• GL.iNet GL-RM10RC firmware version 1.8.1
• GL.iNet GL-RM1PE firmware version 1.8.1

Discovery Timeline

• April 9, 2026 - CVE-2026-5959 published to NVD
• April 9, 2026 - Last updated in NVD database

Technical Details for CVE-2026-5959

Vulnerability Analysis

This authentication bypass vulnerability (CWE-287) exists within the Factory Reset Handler component of GL.iNet KVM devices. When a factory reset is performed on affected devices, the authentication mechanisms fail to properly reinitialize, creating a window of opportunity for unauthorized remote access. The vulnerability requires network access to exploit but demands a high level of attack complexity, making successful exploitation difficult but not impossible for determined attackers.

The flaw resides in how the device handles credential and session state during the factory reset process. Rather than properly invalidating existing sessions and requiring fresh authentication, the handler leaves the device in a vulnerable state where authentication checks can be circumvented.

Root Cause

The root cause stems from improper authentication implementation (CWE-287) in the Factory Reset Handler. The component fails to properly enforce authentication requirements after a reset operation, allowing network-accessible requests to bypass normal credential validation. This design flaw enables attackers who can reach the device over the network to gain unauthorized access without providing valid credentials.

Attack Vector

The attack is initiated remotely over the network, targeting the Factory Reset Handler component. An attacker with network access to the vulnerable device can exploit the improper authentication handling that occurs after a factory reset. While the attack vector is network-based, the high complexity involved means attackers require specific timing, knowledge of the device state, and potentially additional conditions to successfully exploit the vulnerability.

The exploitation scenario involves:

1. Identifying a vulnerable GL.iNet KVM device on the network
2. Triggering or waiting for a factory reset condition
3. Exploiting the authentication bypass window before proper security state is restored
4. Gaining unauthorized access to the device management interface

For detailed technical information about this vulnerability, refer to the GitHub CVE-issues Document maintained by GL.iNet.

Detection Methods for CVE-2026-5959

Indicators of Compromise

• Unexpected or unauthorized access to KVM device management interfaces
• Login events occurring without corresponding valid authentication attempts in device logs
• Factory reset operations followed by immediate remote access from unknown IP addresses
• Unusual network traffic patterns targeting KVM management ports

Detection Strategies

• Monitor network traffic for unauthorized connections to GL.iNet KVM devices, particularly following factory reset events
• Implement network segmentation to isolate KVM infrastructure and enable targeted monitoring
• Deploy intrusion detection rules to identify authentication bypass attempts against affected device models
• Review access logs for management interface connections that lack proper authentication trails

Monitoring Recommendations

• Enable comprehensive logging on all GL.iNet KVM devices and forward logs to a centralized SIEM
• Configure alerts for factory reset events on production KVM infrastructure
• Monitor for firmware version 1.8.1 across device inventory to identify vulnerable systems
• Implement network-level monitoring for management interface access patterns

How to Mitigate CVE-2026-5959

Immediate Actions Required

• Upgrade all affected GL.iNet KVM devices to firmware version 1.8.2 or later immediately
• Restrict network access to KVM device management interfaces to trusted administrative networks only
• Audit recent access logs for signs of unauthorized access, particularly following any factory reset events
• Implement network segmentation to limit exposure of vulnerable devices until patching is complete

Patch Information

GL.iNet has released firmware version 1.8.2 which resolves this authentication bypass vulnerability. The vendor was contacted early during the disclosure process, responded professionally, and quickly released the fixed version. Organizations should prioritize upgrading all affected devices to version 1.8.2 or later. The updated firmware can be obtained from the GL.iNet KVM Download page.

Workarounds

• Implement strict network access controls to limit connectivity to KVM management interfaces
• Place affected devices behind a VPN or firewall that requires authentication before network access
• Disable remote management capabilities temporarily if immediate patching is not feasible
• Monitor for and investigate any factory reset events on production devices

# Network isolation configuration example (firewall rules)
# Restrict KVM management interface access to trusted admin network only
iptables -A INPUT -p tcp --dport 443 -s 10.0.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP