CVE-2026-36182
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
GNCC GP5 v7.1.76 uses a weak hashing algorithm to protect the root password. Attackers can perform a brute-force attack to obtain root credentials and escalate privileges.
Risk Assessment
Gaining root access to the device can lead to full system compromise, data theft, and further attacks within the network.
Recommendation
Update the GNCC GP5 software to the latest version that uses a strong hashing algorithm. If an update is unavailable, restrict device access and implement additional authentication mechanisms.
Other vulnerabilities in GNCC GP5
See all- CVE-2026-36180Medium
A lack of runtime integrity in GNCC GP5 v7.1.76 allows physically-proximate attackers to bypass file system read-only protections and modify system files and binaries for the duration of a boot session via a bind-mount attack.
- CVE-2026-36178Medium
The factory reset functionality in GNCC GP5 v7.1.76 fails to clear sensitive cryptographic material in the JFFS2 configuration partition, possibly allowing attackers to recover and obtain sensitive user data.
- CVE-2026-36176High
GNCC GP5 v7.1.76 stores pre-signed Backblaze B2 upload URLs (PUT requests) in plaintext to the serial console. Physically-proximate attackers can extract these active tokens to perform unauthorized operations via monitoring the serial UART interface.
- CVE-2026-36174Medium
GNCC GP5 v7.1.76 stores sensitive wireless network information in plaintext during routine operations to the serial console, allowing physically-proximate attackers to obtain sensitive information, including network credentials, via monitoring the serial UART interface.
Original NVD description (English source)
GNCC GP5 v7.1.76 was discovered to utilize a weak hashing algorithm to protect the root password, possibly allowing attackers to obtain root credentials and privileges via a bruteforce attack.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS