GNCC GP5 CVE-2026-36182

Exploitation requires the attacker to first obtain the weak hash of the root password from the GP5 device - by extracting it from a vendor-provided firmware image, dumping flash via the device's UART/JTAG header, or leveraging a separate file-read primitive - after which offline brute-force against the weak algorithm becomes feasible. Limiting factors: the description does not document a remote method to read the hash off an un-tampered, default-configured device, so true unauthenticated network exploitation is not established despite the AV:N CVSS vector; the attack is confined to GP5 firmware v7.1.76, and credential recovery only matters where the recovered root password is reused on a network-reachable service (SSH, telnet, web admin). No vendor advisory clarifies whether the hash is exposed via any default-enabled network service.

Signals conflict here and need careful weighing. CVSS 3.1 rates this 9.8 critical with AV:N/AC:L/PR:N/UI:N, but that scoring assumes the attacker already possesses the weak hash - the description itself notes the attack proceeds 'via a bruteforce attack' against the hash, which in practice requires first obtaining the credential store from the device (physical access, firmware dump, or a separate disclosure flaw). EPSS is only 0.02% (4th percentile), the CVE is not on CISA KEV, no public exploit identified at time of analysis, and the tag 'Information Disclosure' more accurately reflects the primitive than 'Remote Code Execution.' Realistic prioritization is moderate, not critical: an opportunistic mass-exploit campaign is unlikely, but any defender who has already exposed the device's filesystem (e.g., via UART, prior firmware leak, or a chained vuln) should treat root recovery as trivial. Note the discrepancy: CVSS network vector versus a description that implies the hash must first be extracted - verify the attack chain with the researcher's GitHub write-up before treating this as remotely exploitable without preconditions.

An attacker who has obtained the device's credential file - for example via a firmware image downloaded from the vendor, a UART/serial port on the PCB, or a chained file-disclosure bug - runs hashcat or John the Ripper against the weak hash and recovers the root password within minutes on commodity GPU hardware. They then log in as root over SSH or the device's management interface and pivot to lateral movement, persistent malware installation, or surveillance of the camera feed. No public exploit identified at time of analysis, but the cracking step is well within the capability of any researcher with off-the-shelf tools.