The vulnerability stems from GNCC GP5 firmware that writes wireless network credentials and related sensitive data in clear text to the serial UART stream during routine operations. This flaw creates a direct data leak that can be read by anyone with physical proximity to the UART interface, allowing an attacker to recover passwords and network configuration details. The weakness is a classic example of information exposure, potentially enabling unauthorized network access for the attacker.

NI devices based on the GNCC GP5 platform running firmware version 7.1.76 are affected. The issue is confined to the device’s serial console subsystem, and no other firmware or hardware components are explicitly mentioned.

The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating that no publicly reported exploits exist. Nevertheless, because it requires only physical proximity to the device’s UART interface, the attack vector is low‑barrier and can be executed with minimal tools. In environments where physical security is weak, the risk of credential compromise remains high. The CWEs associated with this flaw are primarily information exposure, underscoring the need for data‑at‑rest or data‑in‑transit protection measures.