What is the CVSS score of CVE-2026-36176?

CVE-2026-36176 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of GNCC GP5 are affected by CVE-2026-36176?

GNCC GP5 camera firmware v7.1.76 leaks Backblaze B2 cloud storage credentials, enabling unauthorized modification of cloud-stored video and backups for organizations that deployed these devices.

How to fix or mitigate CVE-2026-36176?

Within 24 hours: Inventory all GNCC GP5 devices in use; identify which have Backblaze B2 integration enabled; assess physical security of device locations. Within 7 days: Restrict physical access to identified vulnerable cameras; rotate Backblaze B2 credentials with shorter token expiration windows; enable comprehensive logging of B2 bucket activity to detect unauthorized uploads. Within 30 days: Subscribe to vendor security bulletins for firmware updates; validate patch compatibility with existing systems; develop device upgrade and replacement timeline for high-risk deployments.

GNCC GP5 CVE-2026-36176

EUVD-2026-34279 HIGH

Cleartext Storage of Sensitive Information (CWE-312)

2026-06-04 mitre

GHSA-82x6-h78j-2frc

Authentication Bypass N A

7.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.1 HIGH

AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 17:22 vuln.today

CVSS changed

Jun 04, 2026 - 17:22 NVD

7.1 (HIGH)

CVE Published

Jun 04, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

GNCC GP5 v7.1.76 was discovered to store pre-signed Backblaze B2 upload URLs (PUT requests) in plaintext to the serial console. This allows physically-proximate attackers to extract these active tokens to perform unauthorized operations via monitoring the serial UART interface.

AnalysisAI

Plaintext exposure of pre-signed Backblaze B2 upload URLs in GNCC GP5 camera firmware v7.1.76 allows physically-proximate attackers with serial UART access to harvest live cloud storage tokens. The leaked PUT URLs enable unauthorized write operations against the device's Backblaze B2 cloud storage bucket until the tokens expire. No public exploit identified at time of analysis, though a public research write-up describing the issue is referenced.

Technical ContextAI

The GNCC GP5 is an IoT camera that uses Backblaze B2 cloud object storage for media upload, relying on pre-signed URLs - time-limited, capability-bearing tokens that grant whoever holds them the right to perform the embedded HTTP operation (here, PUT) without further authentication. The root cause is CWE-312 (Cleartext Storage of Sensitive Information): the firmware emits these bearer-equivalent URLs to the serial console output stream via the UART debug interface, where they persist as plaintext readable by anyone with hardware access. The CPE entry from NVD is a placeholder (cpe:2.3:a:n/a:n/a) and does not formally enumerate the affected product, so version coverage relies solely on the description's reference to v7.1.76.

RemediationAI

No vendor-released patch identified at time of analysis - neither GNCC nor a fixed firmware version is referenced in the available data. As compensating controls, operators should physically secure deployed GP5 cameras to prevent UART access (tamper-evident enclosures, mounting in inaccessible locations), and where possible disable or remove the serial debug header on the PCB, accepting the trade-off that this complicates legitimate diagnostics. On the cloud side, rotate or shorten the lifetime of Backblaze B2 pre-signed URL expirations to narrow the abuse window, and monitor the associated B2 bucket for anomalous PUT activity from unexpected source IPs. Consult the research write-up at https://github.com/BadChemical/IoT-Vulnerability-Research-Public/blob/main/GNCC-GP5-T23/README.md and the VulDB entry https://vuldb.com/vuln/368357 for further detail, and contact GNCC via http://gncc.com to request a firmware fix.