What is the CVSS score of CVE-2025-71056?

CVE-2025-71056 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of GCOM EPON are affected by CVE-2025-71056?

A critical session hijacking vulnerability in GCOM EPON 1GE ONU devices (version C00R371V00B01) allows attackers to impersonate authenticated users by spoofing IP addresses, potentially granting…

How to fix or mitigate CVE-2025-71056?

Within 24 hours: Identify and inventory all affected GCOM EPON 1GE ONU devices running version C00R371V00B01 in your network; isolate affected devices to a restricted VLAN pending remediation. Within 7 days: Implement network segmentation to restrict ONU device access to authorized management networks only; enable enhanced logging and monitoring for suspicious session activity; contact GCOM for patch availability and timeline. Within 30 days: Deploy compensating controls (IP spoofing detection, strict MAC/IP binding); evaluate replacement of affected devices or upgrade to patched firmware version when available; conduct security audit of ONU device management practices.

GCOM EPON CVE-2025-71056

HIGH

Authentication Bypass by Spoofing (CWE-290)

2026-02-23 cve@mitre.org

Authentication Bypass

8.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 23, 2026 - 21:19 nvd

HIGH 8.1

DescriptionCVE.org

Improper session management in GCOM EPON 1GE ONU version C00R371V00B01 allows attackers to execute a session hijacking attack via spoofing the IP address of an authenticated user.

AnalysisAI

Improper session management in GCOM EPON 1GE ONU version C00R371V00B01 allows attackers to execute a session hijacking attack via spoofing the IP address of an authenticated user. [CVSS 8.1 HIGH]

Technical ContextAI

Classified as CWE-290 (Authentication Bypass by Spoofing). Improper session management in GCOM EPON 1GE ONU version C00R371V00B01 allows attackers to execute a session hijacking attack via spoofing the IP address of an authenticated user.

Affected ProductsAI

Improper session management in GCOM EPON 1GE ONU version C00R371V00B01 allows attackers to execute a session hijacking attack via spoofing the IP addr