{"id":"CVE-2026-124599","aliases":[],"cve":{"records":[{"id":"CVE-2026-124599","source":"GV","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-09T01:42:46.616Z","published":"2026-11-10T00:21:11.810Z","modified":"2026-11-12T17:26:05.083Z"}],"publishers":[{"name":"GV","role":"CNA","organizationId":"0df08a0e-a200-4957-9bb0-084f562506f9","modified":"2026-11-10T00:21:11.810Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-12T17:26:05.083Z"}],"references":[{"url":"https://dlcdn.geovision.com.tw/TechNotice/CyberSecurity/2026/Security_Advisory_GV-Eye-2026-09-01.pdf","tags":[],"source":"GV"}],"weaknesses":[{"id":"CWE-321","description":"CWE-321 Use of hard-coded cryptographic key","source":"GV"}],"applicability":[{"source":"GV","statements":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:geovision_inc.:gv-face:2.2.1:*:android:*:*:*:*:*"},{"vulnerable":false,"criteria":"cpe:2.3:a:geovision_inc.:gv-face:2.2.2:*:android:*:*:*:*:*"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-12T17:25:29.230280Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Hardcoded RSA Private Key and Public Key Exposure in GV-Face Android Application v2.2.1","titleSource":"GV","descriptionSource":"GV","description":"The RSA cryptographic key material, including a private key and public key, is\nembedded within the application package. Because Android applications can\nbe extracted and reverse engineered, storing private cryptographic keys\ndirectly inside the client application may allow an attacker to recover the\nkeys and potentially use them to impersonate the application, decrypt protected\ndata, or generate unauthorized cryptographic operations.","score":6.2,"severity":"medium","published":"2026-11-10T00:21:11.810Z","modified":"2026-11-12T17:26:05.083Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"GeoVision Inc.","name":"GV-Face","platforms":["Android"],"versions":[{"version":"2.2.1","status":"affected"},{"version":"2.2.2","status":"unaffected"}],"defaultStatus":"unaffected","cpes":[],"source":"GV","url":"https://www.cve.org/CVERecord?id=CVE-2026-124599"}],"remediation":[],"references":["https://dlcdn.geovision.com.tw/TechNotice/CyberSecurity/2026/Security_Advisory_GV-Eye-2026-09-01.pdf"],"sources":[{"name":"CVE","id":"CVE-2026-124599","modified":"2026-11-12T17:26:05.083Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-124599"}],"assessments":[{"source":"GV","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":6.2}],"sourceAffected":[],"observedAt":"2026-11-12T19:07:11.028Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T21:45:32.848Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-10T02:10:32.101Z","attemptedAt":"2026-11-10T02:10:32.101Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-10T02:10:31.074Z","attemptedAt":"2026-11-10T02:10:31.074Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-10T02:10:32.097Z","attemptedAt":"2026-11-10T02:10:32.097Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-10T02:10:32.638Z","attemptedAt":"2026-11-10T02:10:32.638Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-120666","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-120666","modified":"Nov 10, 2026, 12:21:11 AM","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-11-10T02:10:32.097Z"},{"source":"NVD","id":"CVE-2026-124599","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124599","modified":"2026-11-10T01:17:18.333","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-11-10T02:10:32.101Z"}],"aiSummary":null}