Review reviewHigh

CVE-2026-45433

GX INDIA GX Earth 2022, GX Earth 1010

This vulnerability exists in GX Earth 2022 ONT models due to the presence of hardcoded RSA private key within the device firmware. A remote attacker could exploit this vulnerability by extracting the cryptographic private key from the firmware, which could lead to decryption of HTTPS traffic and Man-in-the-Middle (MITM) attacks on the targeted device.

CVSS: 8.7
EPSS: 0.34%
CISA KEV: Not listed
Published: 2026.06.04

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.34%

Technical severityCVSS 8.7

Vulnerability overview

Affected product and versions

Product: GX INDIA GX Earth 2022, GX Earth 1010
Affected versions: >= version E2022 - 3.1.2A, >= version E2022 - 3.1.5AV, >= version E2022 - 1.1ASL, >= version E1010-1.1ASL
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that GX INDIA GX Earth 2022, GX Earth 1010 and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE: CWE-321