Why a KVM needs more care than remote desktop
Remote desktop runs inside the operating system and stops at its login screen. A KVM sits outside the OS. It can enter firmware setup, change the boot order and boot an image you mount, so whoever controls the console effectively controls the machine. CISA's Binding Operational Directive 23-02 gives the official view of this class of risk. It names out-of-band server management interfaces such as iLO and iDRAC, and says threat actors have targeted network devices and used some classes of them to gain unrestricted access to organizational networks. [1]
The checklist below is grouped by layer: accounts, exposure, the access path, updates, and the physical box. Work through it once at setup and again whenever you add a person or a remote path.
Layer 1: accounts and sign-in
CISA's Secure by Design alert urges manufacturers to eliminate static default passwords, because attackers exploit them. On your side, never leave a device on a shared or guessable password. GL.iNet's Comet Pro has no default password: you create the admin password on first access. Its console then offers a password change, two-factor authentication and a custom TLS certificate. [2][3][4]
JetKVM's local password is optional, but JetKVM recommends setting one. Without it, anyone on your network who knows the device's IP can control the computer. Sessions last 7 days. After 5 wrong passwords, sign-ins from that computer are blocked for 15 minutes, rising to as long as an hour if attempts continue. Remote cloud access uses the cloud account instead of the local password. [8][9]
- Set a long, unique admin password and store it in a password manager.
- Turn on two-factor sign-in on the device where offered (Comet Pro console). [4]
- Secure the vendor cloud account too: Google for JetKVM Cloud, a GL.iNet account for glkvm.com. [9][3]
- Sign out after each session on shared computers; JetKVM keeps a browser signed in for 7 days. [8]
Layer 2: exposure, no port forwarding
The single most important rule: do not forward a router port to the KVM's web console. CISA tells federal agencies to remove such interfaces from the internet, or to put a policy enforcement point in front that is separate from the interface. A home user can do the same with a VPN or a vendor relay. [1]
Neither device needs port forwarding. GL.iNet's FAQ says no open ports or public IP are needed, with its cloud, Tailscale, ZeroTier or NetBird as the paths. JetKVM Cloud uses WebRTC directly between browser and device and relays through Cloudflare TURN only when a firewall or carrier-grade NAT blocks a direct connection. [5][9]
Layer 3: choose the access path deliberately
Each path moves the trust to a different account. A mesh VPN keeps the KVM off vendor clouds but makes your VPN account the key. Tailscale says its DERP relays forward WireGuard-encrypted traffic they cannot decrypt, because private keys never leave the devices. JetKVM makes a similar claim for its TURN relay. JetKVM Cloud also accepts only the account that adopted the device. [10][9]
| Path | What protects it | Extra step |
|---|---|---|
| Local network only | Device password; your Wi-Fi security | Isolate guests from the KVM |
| Vendor cloud (glkvm.com or JetKVM Cloud) | Cloud account plus device password [3][9] | Enable 2FA on the cloud account where offered |
| Tailscale or another mesh VPN | VPN account and device keys; encrypted relays [10] | Restrict who in the tailnet can reach the KVM |
| Port forward to the console | Only the device login | Do not use [1] |
Layer 4: updates and unused access
GL.iNet KVMs check for firmware by clicking the version number in the console. You can also install a file from GL.iNet's download center. GL.iNet warns that beta builds may be unstable, so keep beta firmware off a device you rely on for recovery. JetKVM publishes a vulnerability disclosure policy, with private GitHub security advisories as the preferred channel. Watch its release notes and advisories for fixes. [6][11]
- Check for firmware updates monthly and after any published advisory.
- Avoid beta firmware on a recovery device. [6]
- Unbind cloud access and remove VPN apps you no longer use.
- Remove shared users when someone no longer needs access.
Layer 5: the physical box
Physical access defeats most of the above. GL.iNet's product overview says holding the reset pinhole for 8 seconds resets Comet Pro, and the touchscreen offers a lock screen. JetKVM has no way to recover a forgotten password; you erase the settings instead. That is safe for you, but it also means anyone with the device in hand can wipe and re-adopt it. Keep the KVM in a locked room or cabinet with the computer it controls, and turn on the screen lock where available. [7][8]
One-page checklist
| Check | Done when |
|---|---|
| Unique admin password | Stored in a password manager; no shared password |
| Two-factor sign-in | Enabled on the device and the cloud account where offered |
| No port forwards | Router shows no rule pointing at the KVM |
| One chosen remote path | Others disabled; tested from outside the home |
| Firmware current, not beta | Version noted with the date checked |
| Access list reviewed | Only current people and devices can connect |
| Physical placement | Out of reach of visitors; screen lock on |
Questions before you decide
Is port forwarding to a KVM ever acceptable?
It is the option to avoid. CISA's directive for federal agencies tells them to take management interfaces, including out-of-band server interfaces like iLO and iDRAC, off the public internet or protect them with a separate policy enforcement point. GL.iNet's FAQ says remote access to its KVMs needs no open ports at all.
Can the vendor relay read my KVM session?
JetKVM says its sessions are encrypted end to end with DTLS and SRTP and that the Cloudflare TURN relay it falls back to cannot read the traffic. Tailscale says its DERP relays forward already-encrypted WireGuard traffic they cannot decrypt.
What happens if I forget the KVM password?
On JetKVM there is no way to recover the password itself. You erase the settings, which also removes the cloud connection and network settings. On Comet Pro, GL.iNet documents an 8-second reset through the pinhole. Either way, someone has to act on site.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- CISA: Binding Operational Directive 23-02, Mitigating the risk from internet-exposed management interfaces Accessed 30 Oct 2026
- CISA: Secure by Design Alert, eliminating default passwords Accessed 30 Oct 2026
- GL.iNet KVM Docs: GL-RM10 Quick Setup Accessed 30 Oct 2026
- GL.iNet KVM Docs: GL-RM10 Console Guide Accessed 30 Oct 2026
- GL.iNet KVM Docs: Quick FAQs about GL.iNet KVM Accessed 30 Oct 2026
- GL.iNet KVM Docs: Firmware upgrade Accessed 30 Oct 2026
- GL.iNet KVM Docs: GL-RM10 Product Overview Accessed 30 Oct 2026
- JetKVM Docs: Password Accessed 30 Oct 2026
- JetKVM Docs: JetKVM Cloud Accessed 30 Oct 2026
- Tailscale Docs: DERP servers Accessed 30 Oct 2026
- JetKVM: Security and vulnerability disclosure Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.