Technical impact
The vulnerability stems from GNCC GP5 firmware that writes wireless network credentials and related sensitive data in clear text to the serial UART stream during routine operations. This flaw creates a direct data leak that can be read by anyone with physical proximity to the UART interface, allowing an attacker to recover passwords and network configuration details. The weakness is a classic example of information exposure, potentially enabling unauthorized network access for the attacker.
Affected Systems
Devices powered by GNCC GP5 firmware version 7.1.76 are affected. The issue is confined to the device’s serial console subsystem, and no other firmware or hardware components are explicitly mentioned in the data.
Risk and Exploitability
The EPSS score is below 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known public exploits. Because it requires only physical proximity to the device’s UART interface, the attack vector is low‑barrier and can be executed with minimal tools. In environments where physical security is weak, the risk of credential compromise remains significant. The CVSS score of 4.6 points to moderate severity.
