CVE-2026-36175
6.8 MEDIUMAn issue in the U-Boot component of GNCC GP5 v7.1.76 allows physically-proximate attackers to bypass authentication and gain root access ...
Published: 2026-06-04 · Last updated: 2026-06-04
Severity and scoring
- CVSS
- 6.8 MEDIUM
- Vector
- CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-20, CWE-288
Description
An issue in the U-Boot component of GNCC GP5 v7.1.76 allows physically-proximate attackers to bypass authentication and gain root access via interrupting the boot sequence and injecting a crafted string into the kernel boot arguments.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-36175
- [Other]http://gncc.com
- [Other]http://gp5.com
- [Other]https://github.com/BadChemical/IoT-Vulnerability-Research-Public/blob/main/GNCC-GP5-T23/README.md
- [Other]https://github.com/BadChemical/IoT-Vulnerability-Research-Public/blob/main/GNCC-GP5-T23/README.md
Related CVEs
Same CWE
- CVE-2026-49218 — ImageMagick is free and open-source software used for editing and manipulating digital images (7.5 HIGH)
- CVE-2024-21944 — Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a ... (5.3 MEDIUM)
- CVE-2026-48110 — Russh is a Rust SSH client & server library (7.5 HIGH)
- CVE-2026-48108 — Russh is a Rust SSH client & server library (5.3 MEDIUM)
- CVE-2026-48107 — Russh is a Rust SSH client & server library (6.5 MEDIUM)