{"id":"CVE-2026-112164","aliases":[],"cve":{"records":[{"id":"CVE-2026-112164","source":"ENISA","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-19T08:06:39.207Z","published":"2026-11-09T16:12:42.308Z","modified":"2026-11-09T17:34:41.940Z"}],"publishers":[{"name":"ENISA","role":"CNA","organizationId":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","modified":"2026-11-09T16:12:42.308Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-09T17:34:41.940Z"}],"references":[{"url":"https://github.com/livieromarco/security-advisories/blob/main/advisories/CVE-2026-112164.md","tags":["technical-description"],"source":"ENISA"}],"weaknesses":[{"id":"CWE-321","description":"CWE-321","source":"ENISA"},{"id":"CWE-522","description":"CWE-522","source":"ENISA"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-09T17:22:53.695838Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Hardcoded AES Key Enables Credential Disclosure","titleSource":"ENISA","descriptionSource":"ENISA","description":"The LaserGest mobile application encrypts stored assistance portal credentials with a hardcoded AES key and IV, allowing an attacker with access to the application package to recover them in cleartext.","score":6.6,"severity":"medium","published":"2026-11-09T16:12:42.308Z","modified":"2026-11-09T17:34:41.940Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"laservideo","name":"lasergest","platforms":["iOS","Android"],"versions":[{"version":"1.0.18","status":"affected","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"ENISA","url":"https://www.cve.org/CVERecord?id=CVE-2026-112164"}],"remediation":[],"references":["https://github.com/livieromarco/security-advisories/blob/main/advisories/CVE-2026-112164.md"],"sources":[{"name":"CVE","id":"CVE-2026-112164","modified":"2026-11-09T17:34:41.940Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-112164"}],"assessments":[{"source":"ENISA","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N/E:U","score":6.6}],"sourceAffected":[],"observedAt":"2026-11-09T17:51:58.219Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T21:45:32.848Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-09T16:25:39.022Z","attemptedAt":"2026-11-09T16:25:39.022Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-09T16:25:39.209Z","attemptedAt":"2026-11-09T16:25:39.209Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-09T16:25:39.882Z","attemptedAt":"2026-11-09T16:25:39.882Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-09T16:25:39.192Z","attemptedAt":"2026-11-09T16:25:39.192Z"}],"evidence":[],"aiSummary":{"text":"The LaserGest mobile application's hardcoded AES key and IV may allow an attacker with access to the application package to recover stored credentials in cleartext, affecting version 1.0.18. The weakness is related to hardcoded cryptographic keys. An attacker needs access to the application package.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-09T16:21:09.637Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-112164"}]}}