CVE-2025-71056

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-23 · updated 2026-07-05
Weakness: CWE-290

Description

Improper session management in GCOM EPON 1GE ONU version C00R371V00B01 allows attackers to execute a session hijacking attack via spoofing the IP address of an authenticated user.

References

https://github.com/theShinigami/CVE-Disclosures/blob/main/CVE-2025-71056/README.md
https://johnbai.en.made-in-china.com/product/JXnENzmlJFpv/China-H18gn-Series-Gpon-Ont-ONU.html

Get alerted when CVE-2025-71056 or the next vulnerability affects your stack