CVE-2026-45433: Hardcoded Cryptographic Key Vulnerability in GX Earth ONT Models

Synopsis

A hardcoded RSA private key vulnerability exists in GX Earth ONT (Optical Network Terminal) device firmware across multiple GX INDIA GX Earth 2022 and GX Earth 1010 models. The private key is embedded directly in the firmware image and is reachable by any remote attacker over the network without authentication. Successful exploitation allows an attacker to decrypt HTTPS traffic to and from affected devices and perform man-in-the-middle attacks, intercepting or reading communications in transit. HarborGuard is tracking this advisory as no upstream fix has been published yet.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected device over the network; the vulnerability is exploitable remotely without requiring LAN or physical proximity.

• AuthenticationNot required

  No account or credentials are needed; any unauthenticated remote party can attempt to extract the firmware and obtain the hardcoded key.

• Victim interactionNot required

  Exploitation requires no action from a user or administrator on the affected device.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and places no special environmental conditions or timing constraints on the attacker.

Blast Radius

• An attacker who extracts the hardcoded RSA private key can decrypt recorded or intercepted HTTPS sessions between clients and the affected ONT device, reading plaintext credentials, session tokens, and management traffic.
• With the private key in hand, an attacker can impersonate the device in a man-in-the-middle position, silently reading or relaying traffic that clients believe is encrypted and authenticated.
• Confidential configuration data, ISP provisioning parameters, and any secrets exchanged over the device's HTTPS management interface are exposed to passive decryption.