The vulnerability in GNCC GP5 v7.1.76 involves the insecure storage of pre-signed Backblaze B2 upload URLs (used for PUT requests) in plaintext on the device's serial console output. This allows attackers who can monitor the serial UART interface physically near the device to capture these active tokens and misuse them for unauthorized actions. There is no information on affected versions beyond v7.1.76, no CVSS score assigned, and no vendor advisory or patch information available at this time.

An attacker with physical access to the device's serial UART interface can extract active pre-signed upload URLs, enabling unauthorized operations on the Backblaze B2 storage service. This could lead to unauthorized data uploads or modifications. The lack of patch or mitigation guidance increases the risk until addressed. No exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict physical access to the device's serial console interface to prevent attackers from capturing sensitive tokens.