The vulnerability CVE-2026-45433 arises from the presence of a hardcoded RSA private key within the firmware of GX Earth 2022 ONT models by GX INDIA. This cryptographic weakness (CWE-321) allows an unauthenticated remote attacker to extract the private key, which can be used to decrypt HTTPS traffic and perform Man-in-the-Middle attacks on the device. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, and no privileges or user interaction required. Affected versions are E2022 - 3.1.2A, 3.1.5AV, and 1.1ASL. No patch or official remediation has been disclosed, and no exploits are currently known in the wild.

Exploitation of this vulnerability could lead to compromise of the confidentiality and integrity of HTTPS communications involving the affected devices. An attacker who extracts the hardcoded RSA private key can decrypt intercepted traffic and conduct Man-in-the-Middle attacks, potentially exposing sensitive data or manipulating communications. The vulnerability does not require authentication or user interaction, increasing its risk. However, no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting network access to affected devices and monitoring for unusual activity. Avoid deploying affected versions in sensitive environments if possible. Follow up with GX INDIA for updates on patches or mitigations.