What is the CVSS score of CVE-2026-36174?

CVE-2026-36174 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

GNCC GP5 CVE-2026-36174

EUVD-2026-34277 MEDIUM

Plaintext Storage of a Password (CWE-256)

2026-06-04 mitre

GHSA-wcjq-xfxv-x7mx

Information Disclosure N A

4.6

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

4.6 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 15:39 vuln.today

CVSS changed

Jun 08, 2026 - 15:37 NVD

4.6 (MEDIUM)

CVE Published

Jun 04, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

GNCC GP5 v7.1.76 was discovered to store sensitive wireless network information in plaintext during routine operations to the serial console. This issue allows physically-proximate attackers to obtain sensitive information, including network credentials, via monitoring the serial UART interface.

AnalysisAI

Plaintext credential exposure in GNCC GP5 v7.1.76 allows physically-proximate attackers to capture wireless network credentials by monitoring the device's serial UART interface during routine operations. The device transmits sensitive wireless network information - including network credentials - in cleartext to the serial console, making them trivially readable by anyone with physical access and a UART adapter. No public exploit is identified at time of analysis and no active exploitation is confirmed; however, a researcher-published IoT vulnerability disclosure exists on GitHub detailing the finding.

Technical ContextAI

The GNCC GP5 is an IoT device (firmware v7.1.76) that exposes a serial UART (Universal Asynchronous Receiver-Transmitter) debug/console interface. CWE-256 (Plaintext Storage of a Password) describes the root cause: the device fails to protect sensitive credentials at rest or in transit on the serial bus, instead logging or printing them in cleartext during normal operational routines. UART interfaces are commonly present on embedded and IoT hardware for debugging purposes and are accessible via physical header pins on the PCB. No formal CPE identifier has been assigned (CPE listed as n/a), indicating the product is not yet catalogued in the NVD product dictionary, which may affect automated vulnerability management tooling.

RemediationAI

No vendor-released patch or firmware version is identified at time of analysis. The vendor domains (http://gncc.com, http://gp5.com) should be consulted for firmware updates; if a patched firmware is released, upgrade immediately and rotate any wireless network credentials that may have been exposed. As a compensating control, disable or physically obstruct the UART interface on deployed devices - this typically involves desoldering header pins or applying epoxy to UART pads, which may void warranty and complicate future firmware updates. Network-level miigation: rotate the wireless credentials associated with any device that has been accessible to untrusted individuals, and isolate GP5 devices onto a dedicated VLAN to limit the blast radius of credential theft. Restrict physical access to devices through locked enclosures or secured installations. These controls reduce exploitability but do not remediate the underlying plaintext logging behavior.