# KVM CVEs **URL:** \ **Category:** KVM\ **Created:** [March 19, 2026, 10:59am UTC](https://forum.gl-inet.com/t/kvm-cves/67714 "2026-03-19T10:59:27Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![sullyjman](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/s/5f8ce5/32.png) [@sullyjman](https://forum.gl-inet.com/u/sullyjman)\ **Post date:** [March 19, 2026, 10:59am UTC](https://forum.gl-inet.com/t/kvm-cves/67714/1 "2026-03-19T10:59:27Z")
> **[Researchers disclose vulnerabilities in IP KVMs from four manufacturers](https://arstechnica.com/security/2026/03/researchers-disclose-vulnerabilities-in-ip-kvms-from-4-manufacturers/)** > > Internet-exposed devices that give BIOS-level access? What could possibly go wrong? Where we at with these updates for those not wanting to run beta software on their devices? For those reading, if you have these behind a firewall you are fine (the big concern would be if you already have an attacker on your internal network). The UART isnt even something I would be worried about unless they have physical access to your device Also im sure there are some people out there directly exposing these things to the internet. Please dont do that, it is 2026. Tailscale works very well. ---
**Author:** ![elvisimprsntr](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/e/43a26b/32.png) [@elvisimprsntr](https://forum.gl-inet.com/u/elvisimprsntr)\ **Post date:** [March 19, 2026, 11:19am UTC](https://forum.gl-inet.com/t/kvm-cves/67714/2 "2026-03-19T11:19:16Z")
Precisely why I don’t allow the RM-1 to directly access the internet or use their cloud connect. ---
**Author:** ![xize11](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/xize11/32/5340_2.png) [@xize11](https://forum.gl-inet.com/u/xize11)\ **Post date:** [March 19, 2026, 6:42pm UTC](https://forum.gl-inet.com/t/kvm-cves/67714/3 "2026-03-19T18:42:44Z")
I have mine disabled, I only would enable it if a gl agent/employee wants to check something. Else I use my own wireguard server tunnel so it is only accessible within the tunnel connection. 😀 ---
**Author:** ![robotluo](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/robotluo/32/17434_2.png) [@robotluo](https://forum.gl-inet.com/u/robotluo)\ **Post date:** [March 20, 2026, 1:27am UTC](https://forum.gl-inet.com/t/kvm-cves/67714/4 "2026-03-20T01:27:38Z")
The information in this link is incorrect. We released firmware version 1.7.2 to fix CVE-2026-32293 and CVE-2026-32292 back in October of last year.[https://www.cve.org/CVERecord?id=CVE-2026-32293](https://www.cve.org/CVERecord?id=CVE-2026-32293) CVE-2026-32291: Hackers must possess your physical device CVE-2026-32290: Hackers must first compromise the firmware server, but our firmware server is protected by a professional security service provider.. Of course, we will release firmware updates to fix these two legacy CVEs within the next two days. ---
**Author:** ![minmie](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/minmie/32/25223_2.png) [@minmie](https://forum.gl-inet.com/u/minmie)\ **Post date:** [March 20, 2026, 7:10am UTC](https://forum.gl-inet.com/t/kvm-cves/67714/5 "2026-03-20T07:10:23Z")
Will be fix in 1.8.2 ---
**Author:** ![minmie](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/minmie/32/25223_2.png) [@minmie](https://forum.gl-inet.com/u/minmie)\ **Post date:** [March 20, 2026, 8:16am UTC](https://forum.gl-inet.com/t/kvm-cves/67714/6 "2026-03-20T08:16:56Z")
RM1 /RM10 1.8.2 has been released. RM1PE will also release in a few hours. ---
**Author:** ![system](https://forum-static.gl-inet.com/original/3X/7/7/77e28f6cb342ac4bd641bd9a6254595d61b2812a.png) [@system](https://forum.gl-inet.com/u/system)\ **Post date:** [June 18, 2026, 8:17am UTC](https://forum.gl-inet.com/t/kvm-cves/67714/7 "2026-06-18T08:17:42Z")
This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.