What is the CVSS score of CVE-2026-36178?

CVE-2026-36178 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

GNCC GP5 CVE-2026-36178

EUVD-2026-34280 MEDIUM

Improper Removal of Sensitive Information Before Storage or Transfer (CWE-212)

2026-06-04 mitre

GHSA-r43m-59f7-vgfp

Information Disclosure N A

4.6

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

4.6 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 16:50 vuln.today

CVSS changed

Jun 04, 2026 - 16:22 NVD

4.6 (None) 4.6 (MEDIUM)

CVE Published

Jun 04, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The factory reset functionality in GNCC GP5 v7.1.76 fails to clear sensitive cryptographic material in the JFFS2 configuration partition, possibly allowing attackers to recover and obtain sensitive user data.

AnalysisAI

Factory reset in GNCC GP5 firmware v7.1.76 fails to purge cryptographic material from the JFFS2 configuration partition, leaving sensitive user data recoverable after a reset operation. An attacker with physical access to a reset device - such as a discarded, resold, or stolen unit - can read the raw flash storage and extract retained secrets. No public exploit identified at time of analysis as KEV-confirmed active exploitation, though a publicly available proof-of-concept exists per SSVC data and researcher publication.

Technical ContextAI

The GNCC GP5 is an IoT-class device (likely a GPS tracker or similar consumer/fleet device) running firmware v7.1.76. Its persistent storage uses JFFS2 (Journalling Flash File System 2), a log-structured filesystem common in embedded Linux systems built on NOR/NAND flash. JFFS2's journaling and wear-leveling mechanisms can retain stale data blocks even after logical deletion, and a factory reset that only clears filesystem-layer records without performing a full low-level erase of the flash partition will leave cryptographic key material readable at the raw block level. CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer) captures this class of flaw: the device's reset routine does not securely sanitize the configuration partition before returning the device to a factory state, violating the expectation that a reset destroys prior-owner secrets. CPE data provided is non-specific (n/a), limiting automated product tracking.

RemediationAI

No vendor-released patch has been identified at time of analysis - no fix version is referenced in any of the provided sources, and the vendor advisory pages (http://gncc.com, http://gp5.com) were listed without specific advisory content. Until a firmware update is confirmed, organizations should avoid reselling, donating, or disposing of GNCC GP5 devices without performing a manual low-level flash erase beyond the built-in factory reset function; this requires physical disassembly and use of a flash programmer tool, which may be impractical for end users but feasible for IT asset managers. As a compensating control, operators should treat any returned or decommissioned GP5 unit as potentially containing live credentials and rotate any secrets (API keys, VPN credentials, user account tokens) that were provisioned to the device. The researcher's disclosure at https://github.com/BadChemical/IoT-Vulnerability-Research-Public/blob/main/GNCC-GP5-T23/README.md and VulDB entry https://vuldb.com/vuln/368353 should be monitored for patch announcements. Trade-off: a manual flash erase may render the device unbootable if done incorrectly, and credential rotation requires knowing which secrets were loaded on each device.