{"api_version":"1","generated_at":"2026-11-10T04:24:53+00:00","cve":"CVE-2026-124602","urls":{"html":"https://cve.report/CVE-2026-124602","api":"https://cve.report/api/cve/CVE-2026-124602.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-124602","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-124602"},"summary":{"title":"Hardcoded RSA Private Key and Public Key Exposure in GV-Access Android Application v1.6.1","description":"The RSA cryptographic\nkey material, including a private key and public key, is embedded within the GV-Access application package. Because Android applications can be extracted and\nreverse engineered, storing private cryptographic keys directly inside the\nclient application may allow an attacker to recover the keys and potentially\nuse them to impersonate the application, decrypt protected data, or generate\nunauthorized cryptographic operations.","state":"PUBLISHED","assigner":"GV","published_at":"2026-11-10 01:17:18","updated_at":"2026-11-10 01:17:18"},"problem_types":["CWE-321","CWE-321 CWE-321 Use of hard-coded cryptographic key"],"metrics":[{"version":"3.1","source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary","score":"6.2","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"6.2","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://www.geovision.com.tw/cyber_security.php","name":"https://www.geovision.com.tw/cyber_security.php","refsource":"0df08a0e-a200-4957-9bb0-084f562506f9","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-124602","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124602","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"GeoVision Inc.","product":"GV-Access","version":"affected 1.6.1","platforms":["Android"]},{"source":"CNA","vendor":"GeoVision Inc.","product":"GV-Access","version":"unaffected 1.6.2","platforms":["Android"]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Lloyd Lexter Gealon","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","packageName":"tw.com.geovision.gvaccesscontrol","platforms":["Android"],"product":"GV-Access","vendor":"GeoVision Inc.","versions":[{"status":"affected","version":"1.6.1"},{"status":"unaffected","version":"1.6.2"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:geovision_inc.:gv-access:1.6.1:*:android:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:geovision_inc.:gv-access:1.6.2:*:android:*:*:*:*:*","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"OR"}],"credits":[{"lang":"en","type":"finder","value":"Lloyd Lexter Gealon"}],"datePublic":"2026-11-09T02:35:00.000Z","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>The RSA cryptographic\nkey material, including a private key and public key, is embedded within the GV-Access application package.&nbsp;Because Android applications can be extracted and\nreverse engineered, storing private cryptographic keys directly inside the\nclient application may allow an attacker to recover the keys and potentially\nuse them to impersonate the application, decrypt protected data, or generate\nunauthorized cryptographic operations.</p>"}],"value":"The RSA cryptographic\nkey material, including a private key and public key, is embedded within the GV-Access application package. Because Android applications can be extracted and\nreverse engineered, storing private cryptographic keys directly inside the\nclient application may allow an attacker to recover the keys and potentially\nuse them to impersonate the application, decrypt protected data, or generate\nunauthorized cryptographic operations."}],"impacts":[{"capecId":"CAPEC-37","descriptions":[{"lang":"en","value":"CAPEC-37 Retrieve Embedded Sensitive Data"}]},{"capecId":"CAPEC-191","descriptions":[{"lang":"en","value":"CAPEC-191 Read Sensitive Constants Within an Executable"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-321","description":"CWE-321 Use of hard-coded cryptographic key","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-10T00:23:36.427Z","orgId":"0df08a0e-a200-4957-9bb0-084f562506f9","shortName":"GV"},"references":[{"url":"https://www.geovision.com.tw/cyber_security.php"}],"source":{"discovery":"EXTERNAL"},"title":"Hardcoded RSA Private Key and Public Key Exposure in GV-Access Android Application v1.6.1","x_generator":{"engine":"Vulnogram 1.0.5"}}},"cveMetadata":{"assignerOrgId":"0df08a0e-a200-4957-9bb0-084f562506f9","assignerShortName":"GV","cveId":"CVE-2026-124602","datePublished":"2026-11-10T00:23:36.427Z","dateReserved":"2026-11-09T01:42:46.616Z","dateUpdated":"2026-11-10T00:23:36.427Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-10 01:17:18","lastModifiedDate":"2026-11-10 01:17:18","problem_types":["CWE-321","CWE-321 CWE-321 Use of hard-coded cryptographic key"],"metrics":{"cvssMetricV31":[{"source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.5,"impactScore":3.6}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"124602","Ordinal":"1","Title":"Hardcoded RSA Private Key and Public Key Exposure in GV-Access A","CVE":"CVE-2026-124602","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"124602","Ordinal":"1","NoteData":"The RSA cryptographic\nkey material, including a private key and public key, is embedded within the GV-Access application package. Because Android applications can be extracted and\nreverse engineered, storing private cryptographic keys directly inside the\nclient application may allow an attacker to recover the keys and potentially\nuse them to impersonate the application, decrypt protected data, or generate\nunauthorized cryptographic operations.","Type":"Description","Title":"Hardcoded RSA Private Key and Public Key Exposure in GV-Access A"}]}}}