CVE-2026-36174: GNCC GP5 Plaintext Wireless Credentials Exposure via Serial Console

Technical summary

CVE-2026-36174 is a cleartext information exposure vulnerability affecting GNCC GP5 v7.1.76. The device outputs wireless network configuration and credentials to the serial UART interface without encryption or obfuscation during routine operations. An attacker positioned to monitor the serial port (via UART interface, serial dongle, or hardware tap) can passively capture plaintext credentials. The vulnerability is classified as CWE-256 (Cleartext Storage of Password), reflecting the fundamental design flaw of transmitting sensitive authentication material without protection. Attack surface is inherently limited to physically proximate actors, but the capture method is trivial—no special tools beyond basic serial monitoring are required.

Business impact

While physical proximity is required, unauthorized wireless network access via captured credentials can enable lateral movement, data exfiltration, or establishment of persistent presence within the organization's network. For deployments in co-location facilities, shared campuses, or environments where technicians or contractors have equipment access, this risk is material. The exposure of network credentials violates defense-in-depth principles and may trigger regulatory scrutiny around credential management and data protection controls.

Affected systems

GNCC GP5 version 7.1.76 is confirmed affected. Organizations should verify whether older or newer versions of GNCC GP5 exhibit the same behavior, and consult vendor documentation for the complete affected version range. Any system running v7.1.76 in a production network should be considered at risk.

Exploitability

Exploitability is straightforward from a technical standpoint—monitoring a serial interface requires minimal skill—but it is strictly gated by physical access. An attacker must be present at or near the device to connect to the serial port. This significantly limits the threat actor pool compared to remote vulnerabilities. However, for adversaries already on-site (facility access, supply chain compromise, insider threats), exploitation is trivial and detection is challenging. No authentication, special software, or complex interaction is needed once physical access is established.

Remediation

Upgrade GNCC GP5 to a patched version that does not output credentials to the serial console, or implements encryption/redaction of sensitive data. Until a patch is available, restrict physical access to the device and its serial interfaces using port locks, tamper seals, or segregation. Disable or restrict console access where operationally feasible. Monitor serial output for unauthorized connections. Verify all wireless network credentials after any suspected physical tampering and rotate credentials if compromise is suspected.

Patch guidance

Check the GNCC vendor advisory for availability and version numbers of patched releases. Organizations should test patches in a staging environment before production deployment, particularly given the physical-access nature of this issue—testing can confirm that the patch eliminates plaintext credential output to the serial console. Prioritize patching systems in higher-risk physical environments (co-location, shared facilities, or locations with elevated facility access).

Detection guidance

Implement physical controls: secure the serial port connection area, use port locks or cable locks on serial interfaces, and apply tamper-evident seals. Monitor device access logs if the device supports them. Audit wireless network credentials periodically to identify unauthorized changes or access. Conduct credential reviews following any facility incidents, equipment maintenance, or unauthorized physical access events. For environments permitting it, implement network segmentation to limit impact if wireless credentials are compromised.

Why prioritize this

Although the CVSS score reflects the low network exposure (4.6, MEDIUM), organizations with GNCC GP5 v7.1.76 deployed in shared or less-controlled physical environments should treat this as a priority for access control hardening and patching. The ease of exploitation given physical access, combined with the high-value nature of wireless credentials, justifies rapid remediation. This is not an emergency for secure data centers but warrants urgent attention for edge or co-location deployments.

Risk score, explained

CVSS 3.1 score of 4.6 (MEDIUM) reflects: Attack Vector Physical (restricting scope significantly), low Attack Complexity, no authentication required, no user interaction, and high Confidentiality impact balanced against no integrity or availability impact. The score appropriately captures that exploitation requires on-site presence but succeeds trivially once achieved. Organizations' actual risk depends heavily on the physical security posture of their GNCC GP5 deployments.

Frequently asked questions