# CVE-2026-36180: GNCC GP5 file system integrity bypass via bind-mount attack

Source: https://junglewise.ai/threats/cve-2026-36180-gncc-gp5-file-system-integrity-bypass-via-bind-mount-attack  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-04. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

CVE-2026-36180 · Severity: info · Published 2026-06-04

The GNCC GP5, an IoT device, contains a security flaw that allows an individual with physical access to the hardware to bypass built-in file protections. By manipulating how the system mounts its storage, an attacker can modify critical system files and software that are normally protected as read-only. This could allow an attacker to alter the device's behavior or compromise its security for the duration of the current power cycle.

Technologies: [GNCC GP5](https://junglewise.ai/threats/technologies/gp5). Vendors: [GNCC](https://junglewise.ai/threats/vendors/gncc).

## Quick answers

**Is CVE-2026-36180 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-36180 being exploited in the wild.

**How severe is CVE-2026-36180?** Informational severity, published 4 June 2026.

**Which products and versions are affected?** GNCC GP5 7.1.76.

**Is there a fix for CVE-2026-36180?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-36180 attacked?** It is attacked with physical access, in a network appliance.

**Am I affected by CVE-2026-36180?** Check whether you run GNCC GP5 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The GNCC GP5 (v7.1.76) lacks sufficient runtime integrity checks, making it susceptible to a bind-mount attack. An attacker with physical access to the device can leverage this weakness to bypass read-only file system protections. By performing a bind-mount, the attacker can overlay writable directories over protected system paths, allowing for the modification of system binaries and configuration files. These modifications persist for the duration of the boot session, potentially allowing for arbitrary code execution or unauthorized configuration changes.

## Affected products

- GNCC GP5 7.1.76

## Timeline

- 2026-06-04: disclosed
- 2026-06-04: advisory

## References

- [http://gncc.com/](http://gncc.com/)
- [http://gp5.com/](http://gp5.com/)
- [https://github.com/BadChemical/IoT-Vulnerability-Research-Public/blob/main/GNCC-GP5-T23/README.md](https://github.com/BadChemical/IoT-Vulnerability-Research-Public/blob/main/GNCC-GP5-T23/README.md)

## Related threats

- [GNCC GP5 weak password hashing for root account](https://junglewise.ai/threats/cve-2026-36182-gncc-gp5-weak-password-hashing-for-root-account)
- [GNCC GP5 improper data sanitization in factory reset](https://junglewise.ai/threats/cve-2026-36178-gncc-gp5-improper-data-sanitization-in-factory-reset)
- [GNCC GP5 plaintext token disclosure in serial console](https://junglewise.ai/threats/cve-2026-36176-gncc-gp5-plaintext-token-disclosure-in-serial-console)
- [GNCC GP5 authentication bypass in U-Boot](https://junglewise.ai/threats/cve-2026-36175-gncc-gp5-authentication-bypass-in-u-boot)
- [GNCC GP5 plaintext information disclosure in serial console](https://junglewise.ai/threats/cve-2026-36174-gncc-gp5-plaintext-information-disclosure-in-serial-console)