Technical impact
GNCC GP5 v7.1.76 was found to write pre‑signed Backblaze B2 upload URLs directly to its serial console in plaintext. These URLs authorize a PUT request that can store arbitrary data in the owner’s B2 bucket. A compromise of the tokens enables an attacker to upload any content, effectively hijacking the bucket and potentially exfiltrating stored data. The vulnerability is a classic example of sensitive information being exposed to an unauthorized actor.
Affected Systems
GNCC GP5 equipment running firmware version 7.1.76 is affected. No other versions or products were listed as impacted.
Risk and Exploitability
The EPSS score is not available and the issue is not listed in the CISA KEV catalog, indicating a low publicly documented exploitation probability. The CVSS score is 7.1, indicating a high severity classification. The most common exploitation scenario requires the attacker to be physically proximate to the device’s UART console, which is a relatively constrained attack vector. However, once a physical attacker gains access they can read the exposed tokens and perform unauthorized uploads. Overall, the risk is moderate due to the physical requirement but high for anyone with direct access to the console.
