CVE-2026-45432: Cleartext Transmission of Credentials Vulnerability in GX Earth ONT Models

Synopsis

Cleartext transmission of credentials is present in the web management interface of GX Earth ONT models (E2022 and E1010 product lines). The interface sends user login credentials over unencrypted HTTP, making them readable to any attacker positioned to intercept the network traffic; no authentication or victim interaction is required to capture the data. Successful interception gives the attacker valid credentials, enabling unauthorized login to the targeted device. No fix version has been published yet; HarborGuard tracks this advisory and will surface a patched-image rebuild the moment upstream releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the device's HTTP management interface over the network to intercept the plaintext credential exchange.

• AuthenticationNot required

  No account or prior authentication is needed; the attacker only needs to observe unencrypted traffic.

• Victim interactionNot required

  No user action is required beyond the target performing a normal login over the unencrypted interface.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable; no race conditions or special environmental factors are required to capture the cleartext credentials.

Blast Radius

• An attacker who intercepts traffic reads plaintext login credentials (username and password) as they are transmitted to the management interface.
• With captured credentials, the attacker can authenticate to the targeted ONT device and take full administrative control of its configuration.
• Device configuration changes can redirect, drop, or intercept all traffic passing through the ONT, affecting downstream network users.