Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

GCOM EPON 1GE C00R371V00B01: Remote Access to Sensitive Settings

CVE-2025-63409 · published 8 months ago
Summary

Remote attackers who are already authenticated on a GCOM EPON 1GE C00R371V00B01 device can access and modify administrator settings and obtain the administrator credentials. This could allow them to make changes that impact the device's security and functionality. Update to the latest version to prevent unauthorized access.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
gcomtw gcom_epon_1ge_firmware c00r371v00b01
cpe:2.3:o:gcomtw:gcom_epon_1ge_firmware:c00r371v00b01:*:*:*:*:*:*:*
Original advisory text
Privilege escalation and improper access control in GCOM EPON 1GE C00R371V00B01 allows remote authenticated users to modify administrator only settings and extract administrator credentials.
Privilege escalation and improper access control in GCOM EPON 1GE C00R371V00B01 allows remote authenticated users to modify administrator only settings and extract administrator credentials.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-284Improper Access Control
Timeline
Published24 Feb 2026
Updated31 Oct 2026
First seen6 Mar 2026
Sources
CVE-2025-63409 · NVD
Track software like this
Free during beta