This vulnerability (CVE-2026-45432) involves the cleartext transmission of sensitive user credentials over HTTP in GX INDIA's GX Earth 2022 ONT models. The web management interface does not encrypt authentication data, enabling remote attackers to intercept and capture credentials by monitoring network traffic. The CVSS 4.0 score is 8.7, reflecting high severity due to network attack vector, no required privileges or user interaction, and high impact on confidentiality. The vulnerability affects multiple versions of the GX Earth 2022 product line. No vendor advisory or patch information is currently available, and the product is not a cloud service.

An attacker who can intercept network traffic between the user and the vulnerable GX Earth 2022 device can obtain user credentials in cleartext. This could allow unauthorized access to the device's management interface, potentially leading to further compromise or misuse of the device. The vulnerability impacts confidentiality but does not directly indicate integrity or availability effects. No known exploits are currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid accessing the device management interface over untrusted or public networks. Employ network-level protections such as VPNs or secure tunnels to protect management traffic. Monitor vendor communications for updates regarding official patches or mitigations.