CVE-2026-36182
GNCC GP5 version 7.1.76 stores the root password using a weak hashing algorithm, which could let an attacker guess the password through brute‑force attempts. This flaw allows an attacker to gain full root access to the device.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
GNCC GP5 firmware 7.1.76, used by network device administrators.
Real-world impact
An attacker who succeeds in brute‑forcing the root password can take complete control of the device, modify configurations, install malware, or disrupt services.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability can be exploited over the network with no authentication, no user interaction, and it compromises confidentiality, integrity, and availability of the device.
What to do about it
- ›Change the root password to a strong, unique value.
- ›Limit login attempts or enable account lockout if supported.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources.
Timeline
- Jun 4, 2026 · Jun 4, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.