CVE-2025-71056 — Improper session management in GCOM EPON 1GE ONU version C00R371V00B01 allows attackers to execute a session hijacking attack via spoofing the IP address of an authenticated user

Back Back to CVE browser

HIGH

Improper session management in GCOM EPON 1GE ONU version C00R371V00B01 allows attackers to execute a session hijacking attack via spoofing the IP address of an authenticated user

Published Feb 23, 2026

8.1

HIGH

CVSS 3.1

EPSS 0.22%

Description

Improper session management in GCOM EPON 1GE ONU version C00R371V00B01 allows attackers to execute a session hijacking attack via spoofing the IP address of an authenticated user.

Affected products

Remediation

No remediation recorded yet.

Metrics

0.22% 0.00217

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.00217

Score over time

Feb–Oct 2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (3 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	0.22% (0.00217)	10.98th	v5 (v2026.06.15)
Jun 15, 2026	0.23% (0.00231)	13.63th	v5 (v2026.06.15)
Feb 24, 2026	0.02% (0.00017)	3.65th	v4 (v2025.03.14)

Weaknesses (1)

CWE-290

Authentication Bypass by Spoofing

References (2)

Link	Providers	Tags
https://github.com/theShinigami/CVE-Disclosures/blob/main/CVE-2025-71056/README.md
https://johnbai.en.made-in-china.com/product/JXnENzmlJFpv/China-H18gn-Series-Gpon-Ont-ONU.html