This vulnerability involves the cleartext transmission of user credentials over HTTP in GX Earth 2022 ONT models' web management interface. Because authentication data is not encrypted, an attacker with network access could intercept this information and gain unauthorized access to the device. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality. No vendor advisory or patch information is currently available, and the product is not a cloud service.

An attacker intercepting network traffic can obtain user credentials in plaintext, leading to unauthorized access to GX Earth 2022 ONT devices. This compromises device security and potentially the network environment where the device operates. The vulnerability affects confidentiality but does not indicate impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using the web management interface over untrusted or public networks. Employ network-level protections such as VPNs or secure tunnels to protect management traffic. Monitor vendor communications for updates on official fixes.