CVE-2026-45432: GX Earth ONT Information Disclosure Flaw

CVE-2026-45432 Overview

CVE-2026-45432 affects GX Earth Optical Network Terminal (ONT) models that transmit user credentials in plaintext over HTTP through their web management interface. The flaw maps to [CWE-319]: Cleartext Transmission of Sensitive Information. A remote attacker positioned to observe network traffic can intercept authentication data and gain unauthorized access to the targeted device. Because ONT devices terminate fiber broadband connections, compromise can extend to downstream subscriber networks.

Critical Impact

Network-adjacent attackers can capture administrative credentials by sniffing HTTP traffic, enabling full takeover of the ONT and pivoting into the customer LAN.

Affected Products

• GX Earth ONT models with HTTP-based web management interface
• Refer to the CERT-IN Vulnerability Note CIVN-2026-0288 for the complete affected model list

Discovery Timeline

• 2026-06-04 - CVE-2026-45432 published to the National Vulnerability Database
• 2026-06-04 - Last updated in the NVD database

Technical Details for CVE-2026-45432

Vulnerability Analysis

The GX Earth ONT web management interface serves authentication forms and processes credential submissions over unencrypted HTTP. Usernames and passwords transit the network in plaintext within HTTP request bodies or query parameters. Any device on the path between an administrator and the ONT can read these credentials directly from packet captures.

The vulnerability is exploitable from the network without privileges or user interaction, provided the attacker can observe traffic to the management interface. Typical positions include the LAN segment behind the ONT, a compromised intermediate router, or a rogue access point on the same broadcast domain.

Root Cause

The management interface lacks Transport Layer Security (TLS). HTTPS is either not implemented, not enforced, or the default configuration permits HTTP access without redirection. This violates secure-by-default expectations for credentialed services and is classified under [CWE-319].

Attack Vector

An attacker performs passive sniffing or an active man-in-the-middle (MITM) on the network path between the administrator and the ONT. ARP spoofing, DHCP manipulation, or rogue Wi-Fi access points all yield the required vantage point. The attacker captures the HTTP POST containing the credential pair, then replays them against the web interface to authenticate as the administrator. Once inside, the attacker can modify WAN settings, change DNS servers, exfiltrate configuration data, or use the ONT as a foothold into the subscriber network.

No exploitation code is required beyond standard packet capture utilities. Refer to the CERT-IN Vulnerability Note CIVN-2026-0288 for vendor-specific technical context.

Detection Methods for CVE-2026-45432

Indicators of Compromise

• Unexpected administrative logins to the ONT web interface from LAN hosts that do not normally access management functions
• ARP table anomalies on the management segment, such as duplicate MAC addresses or rapid ARP cache changes
• Configuration changes on the ONT, particularly to DNS, DMZ, or remote management settings, with no corresponding administrator activity

Detection Strategies

• Inspect network traffic for HTTP POST requests carrying username and password form fields directed at the ONT management IP
• Alert on ARP spoofing patterns and unsolicited gratuitous ARP replies on segments hosting ONT management interfaces
• Baseline administrator source IPs and flag logins originating from unusual hosts or off-hours sessions

Monitoring Recommendations

• Capture and retain flow records for the ONT management VLAN to support post-incident analysis
• Forward syslog and authentication events from the ONT to a centralized SIEM for correlation
• Monitor for outbound traffic from the ONT to unknown DNS resolvers or remote management endpoints

How to Mitigate CVE-2026-45432

Immediate Actions Required

• Restrict access to the ONT web management interface to a dedicated management VLAN or trusted host
• Disable remote (WAN-side) administration if it is enabled
• Rotate all administrator credentials after confirming the management path is no longer exposed to plaintext interception
• Contact the device vendor or service provider for firmware updates referenced in the CERT-IN advisory

Patch Information

No public vendor patch is referenced in the NVD entry at the time of publication. Operators should track the CERT-IN Vulnerability Note CIVN-2026-0288 for firmware updates and follow the device vendor's coordinated disclosure channel.

Workarounds

• Place the ONT management interface behind a firewall rule that permits only administrator workstations on a separate VLAN
• Tunnel management sessions over an encrypted channel such as a VPN to prevent plaintext credentials from traversing untrusted segments
• Enable port security and dynamic ARP inspection on switches connected to the ONT to limit MITM opportunities
• Where the device supports it, enforce HTTPS-only access and disable the HTTP listener