CVE-2026-36175 describes a vulnerability in the U-Boot bootloader of GNCC GP5 version 7.1.76. An attacker physically near the device can interrupt the boot process and inject a crafted string into the kernel boot arguments, bypassing authentication mechanisms and gaining root privileges. The vulnerability is classified under CWE-20 (Improper Input Validation) and CWE-288 (Authentication Bypass Using an Alternate Path or Channel). There is no known patch or vendor advisory specifying remediation at this time.

Successful exploitation allows an attacker with physical access to bypass authentication controls and gain full root access to the affected device. This compromises confidentiality, integrity, and availability of the system. The attack requires physical proximity and manipulation during the boot sequence, limiting remote exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict physical access to affected devices and monitor for unauthorized physical interactions during boot. No official fix or temporary workaround has been published.