CVE-2026-36175

MEDIUM EPSS 13.0%

Published Jun 4, 20263w ago · Modified Jun 17, 20262w ago

6.8 CVSS 3.1

Medium

Published Jun 4, 2026 3w ago

Last Modified Jun 17, 2026 2w ago

Description

An issue in the U-Boot component of GNCC GP5 v7.1.76 allows physically-proximate attackers to bypass authentication and gain root access via interrupting the boot sequence and injecting a crafted string into the kernel boot arguments.

CVSS Details

Base Score

6.8

Exploitability

0.9

Impact

5.9

Vector string

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector Physical

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

13.0% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 2

CWE-20 Improper Input Validation Validation

CWE-288

References 3

gncc.com http://gncc.com
gp5.com http://gp5.com
github.com https://github.com/BadChemical/IoT-Vulnerability-Research-Public/blob/main/GNCC-GP5-T23/README.md

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.