CVE-2026-36178 describes a vulnerability in GNCC GP5 version 7.1.76 where the factory reset process fails to erase sensitive cryptographic material stored in the JFFS2 configuration partition. This failure may enable attackers to recover sensitive user data from the device after a factory reset. The vulnerability is classified under CWE-212 (Improper Removal of Sensitive Data) and has a CVSS 3.1 base score of 4.6 with attack vector physical, low attack complexity, no privileges required, no user interaction, and impacts confidentiality only. There is no known patch or official remediation level provided by the vendor as of the published date.

An attacker with physical access to a GNCC GP5 device running version 7.1.76 could potentially recover sensitive cryptographic material that should have been erased during a factory reset. This compromises the confidentiality of user data but does not affect the device's integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid relying solely on the factory reset function to sanitize devices before disposal or transfer. Consider additional manual data wiping or physical destruction of storage media to prevent data recovery.