Is CVE-2026-36174 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-36174 being exploited in the wild.

How severe is CVE-2026-36174?

Informational severity, with a CVSS score of 4.6, published 4 June 2026.

Is there a fix for CVE-2026-36174?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-36174 attacked?

It is attacked with physical access, in a network appliance.

Am I affected by CVE-2026-36174?

Check whether you run GNCC GP5 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-36174: GNCC GP5 plaintext information disclosure in serial console

CVE-2026-36174 · Severity: info · CVSS 4.6 · Published 2026-06-04

The GNCC GP5 smart camera contains a security flaw where it transmits sensitive Wi-Fi credentials in plain text through its internal hardware diagnostic port. An individual with physical access to the device could monitor these communications to steal wireless network passwords. This could lead to unauthorized access to the owner's home or business network.

Technologies: GNCC GP5. Vendors: GNCC.

Quick answers

Is CVE-2026-36174 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-36174 being exploited in the wild.
How severe is CVE-2026-36174?: Informational severity, with a CVSS score of 4.6, published 4 June 2026.
Which products and versions are affected?: GNCC GP5 7.1.76.
Is there a fix for CVE-2026-36174?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-36174 attacked?: It is attacked with physical access, in a network appliance.
Am I affected by CVE-2026-36174?: Check whether you run GNCC GP5 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A cleartext storage and transmission vulnerability exists in the GNCC GP5 smart camera (firmware v7.1.76). During routine boot and operational sequences, the device outputs sensitive configuration data, including Wi-Fi SSIDs and passwords, to the Universal Asynchronous Receiver-Transmitter (UART) serial interface. An attacker with physical access to the device's internal components can intercept this data by connecting to the serial pins on the PCB. This requires no authentication and allows for the full compromise of the local wireless network credentials used by the device.

Affected products

GNCC GP5 7.1.76

Timeline

2026-06-04: disclosed
2026-06-04: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.