CVE-2026-36176: GNCC GP5 v7

Synopsis

An information disclosure vulnerability exists in GNCC GP5 v7.1.76 where pre-signed Backblaze B2 upload URLs are written in plaintext to the serial console (UART interface). An attacker with physical access to the device and a low-privilege account can read these active tokens directly from the serial output without any interaction from a victim. Successful exploitation lets an attacker use the extracted pre-signed URLs to perform unauthorized upload operations against the associated Backblaze B2 storage bucket, exposing and potentially corrupting stored data. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  Physical proximity to the device is required; the attacker must have hands-on access to the serial UART interface rather than reaching it over any network path.

• AuthenticationRequired

  A low-privilege account on the device is sufficient; no administrative or elevated credentials are needed beyond basic access.

• Victim interactionNot required

  No action from any other user or victim is needed; the attacker can monitor the serial console independently.

• Attack complexityDetail

  The exploit is reliable and condition-free; extracting plaintext tokens from the UART output requires no special timing, memory layout knowledge, or environmental prerequisites.

Blast Radius

• Attacker reads active pre-signed Backblaze B2 PUT URLs directly from the serial console output, gaining valid credentials for unauthorized storage operations.
• Attacker uses extracted tokens to upload arbitrary data to the associated Backblaze B2 bucket, potentially overwriting or corrupting stored objects.
• Confidentiality of any data referenced by the pre-signed URLs is compromised for the lifetime of each active token.