CVE-2026-36178 describes a vulnerability in GNCC GP5 version 7.1.76 where the factory reset process fails to erase sensitive cryptographic data stored in the JFFS2 configuration partition. This incomplete data clearing could enable attackers to retrieve sensitive information from the device even after a factory reset operation. The vulnerability is specific to the device's firmware and storage handling. There is no CVSS score or vendor advisory detailing remediation or patch availability at this time.

The vulnerability may lead to unauthorized recovery of sensitive cryptographic material and user data from the device after a factory reset. This could compromise user privacy and security by exposing cryptographic keys or credentials that should have been erased. No evidence of active exploitation is currently known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider additional manual data wiping methods if possible and restrict physical or logical access to devices that have been factory reset to prevent data recovery.