CVE-2026-36178: GNCC GP5 Factory Reset Leaves Cryptographic Keys Uncleared

Technical summary

CVE-2026-36178 is a sensitive data exposure vulnerability affecting the factory reset implementation in GNCC GP5 v7.1.76. The vulnerability stems from incomplete sanitization of cryptographic material stored in the JFFS2 configuration partition during factory reset operations. The flaw is classified under CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer). The CVSS v3.1 score of 4.6 (MEDIUM severity) reflects that exploitation requires physical access to the device (AV:P), but results in high confidentiality impact once access is obtained (C:H).

Business impact

Organizations deploying GNCC GP5 devices must consider the risk of data exposure during device decommissioning or repurposing workflows. If devices are sold, donated, or transferred without secure wiping procedures, recovered cryptographic material could compromise past communications, stored credentials, or sensitive configurations. This is particularly concerning in environments where devices rotate through multiple owners or are refurbished for resale. Regulatory compliance frameworks (such as those governing data protection or secure disposal) may require additional compensating controls to mitigate this gap.

Affected systems

GNCC GP5 version 7.1.76 is confirmed affected. Organizations using this model should verify their deployed firmware versions against vendor advisories and upgrade plans. Versions prior to and after 7.1.76 require vendor confirmation; check the GNCC security advisories for patch availability and version scope.

Exploitability

Exploitation requires physical access to the affected device and technical capability to recover data from the JFFS2 partition—typically via device disassembly or direct storage interface access. This is not a remotely exploitable vulnerability and does not require authentication or user interaction. The attack scenario is most relevant in supply chain, refurbishment, or end-of-life device handling contexts rather than in-field compromise.

Remediation

Apply the vendor patch or firmware update when available from GNCC. Verify the patched version addresses complete cryptographic material erasure during factory reset. Until patched, implement administrative controls: enforce secure device disposal procedures (e.g., physical destruction, verified secure wiping via vendor tools), and track device custody during decommissioning. For devices in the field, prioritize patching systems in environments where device reassignment or refurbishment is planned.

Patch guidance

Contact GNCC for patch availability for GP5 v7.1.76 and confirmation of affected version range. Vendor advisories should specify the patched firmware version and any interim mitigations (e.g., manual secure wipe procedures prior to factory reset). Test patches in a non-production environment before broad deployment. Once available, prioritize patching devices scheduled for refurbishment, resale, or decommissioning.

Detection guidance

Forensic indicators are limited to post-breach recovery scenarios. Organization-level detection focuses on process controls: audit device disposal workflows to ensure patches are applied before factory reset, verify that devices are logged as reset in inventory systems, and implement chain-of-custody logging for refurbished or transferred devices. If breach of refurbished devices is suspected, engage forensic specialists to assess whether recovered cryptographic material correlates to known compromises.

Why prioritize this

Although CVSS 4.6 (MEDIUM) may suggest lower urgency, prioritization depends on your environment: devices regularly subject to refurbishment, resale, or decommissioning warrant expedited patching. Conversely, devices in controlled corporate environments with fixed ownership may be patched on standard timelines. The vulnerability has not been added to CISA's KEV catalog, so no active exploitation pressure is currently documented.

Risk score, explained

The CVSS v3.1 score of 4.6 reflects the physical access requirement (AV:P), low attack complexity (AC:L), no privileges or user interaction needed (PR:N/UI:N), and high confidentiality impact (C:H). Integrity and availability are not affected. Contextually, the score appropriately weights a data exposure risk that is straightforward to execute for an attacker with physical access but less critical for organizations without device refurbishment or high-mobility scenarios.

Frequently asked questions