# CVE-2026-36175: GNCC GP5 authentication bypass in U-Boot

Source: https://junglewise.ai/threats/cve-2026-36175-gncc-gp5-authentication-bypass-in-u-boot  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-04. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

CVE-2026-36175 · Severity: info · Published 2026-06-04

The GNCC GP5, an IoT device, contains a security flaw in its bootloader component. An attacker with physical access to the device can interrupt the startup process to bypass security controls and gain full administrative (root) access. This allows the attacker to take complete control of the device, potentially compromising any data it handles or using it as a foothold in a local network.

Technologies: [GNCC GP5](https://junglewise.ai/threats/technologies/gp5). Vendors: [GNCC](https://junglewise.ai/threats/vendors/gncc).

## Quick answers

**Is CVE-2026-36175 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-36175 being exploited in the wild.

**How severe is CVE-2026-36175?** Informational severity, published 4 June 2026.

**Which products and versions are affected?** GNCC GP5 v7.1.76.

**Is there a fix for CVE-2026-36175?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-36175 attacked?** It is attacked with physical access, in a network appliance.

**Am I affected by CVE-2026-36175?** Check whether you run GNCC GP5 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in the U-Boot bootloader of the GNCC GP5 (v7.1.76) allows for an authentication bypass via the serial console or physical interface. By interrupting the standard boot sequence, an attacker can modify the kernel boot arguments (bootargs). Specifically, injecting a crafted string such as 'init=/bin/sh' into the boot parameters allows the attacker to spawn a root shell instead of the intended initialization process. This grants full system-level access to the underlying Linux operating system without requiring valid credentials.

## Affected products

- GNCC GP5 v7.1.76

## Timeline

- 2026-06-04: disclosed: Initial disclosure via NVD and researcher GitHub repository.

## References

- [http://gncc.com/](http://gncc.com/)
- [http://gp5.com/](http://gp5.com/)
- [https://github.com/BadChemical/IoT-Vulnerability-Research-Public/blob/main/GNCC-GP5-T23/README.md](https://github.com/BadChemical/IoT-Vulnerability-Research-Public/blob/main/GNCC-GP5-T23/README.md)

## Related threats

- [GNCC GP5 weak password hashing for root account](https://junglewise.ai/threats/cve-2026-36182-gncc-gp5-weak-password-hashing-for-root-account)
- [GNCC GP5 file system integrity bypass via bind-mount attack](https://junglewise.ai/threats/cve-2026-36180-gncc-gp5-file-system-integrity-bypass-via-bind-mount-attack)
- [GNCC GP5 improper data sanitization in factory reset](https://junglewise.ai/threats/cve-2026-36178-gncc-gp5-improper-data-sanitization-in-factory-reset)
- [GNCC GP5 plaintext token disclosure in serial console](https://junglewise.ai/threats/cve-2026-36176-gncc-gp5-plaintext-token-disclosure-in-serial-console)
- [GNCC GP5 plaintext information disclosure in serial console](https://junglewise.ai/threats/cve-2026-36174-gncc-gp5-plaintext-information-disclosure-in-serial-console)