{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-124599","assignerOrgId":"0df08a0e-a200-4957-9bb0-084f562506f9","state":"PUBLISHED","assignerShortName":"GV","dateReserved":"2026-11-09T01:42:46.616Z","datePublished":"2026-11-10T00:21:11.810Z","dateUpdated":"2026-11-12T17:26:05.083Z"},"containers":{"cna":{"providerMetadata":{"orgId":"0df08a0e-a200-4957-9bb0-084f562506f9","shortName":"GV","dateUpdated":"2026-11-10T00:21:11.810Z"},"title":"Hardcoded RSA Private Key and Public Key Exposure in GV-Face Android Application v2.2.1","datePublic":"2026-11-09T02:00:00.000Z","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-321","description":"CWE-321 Use of hard-coded cryptographic key","type":"CWE"}]}],"impacts":[{"capecId":"CAPEC-37","descriptions":[{"lang":"en","value":"CAPEC-37 Retrieve Embedded Sensitive Data"}]},{"capecId":"CAPEC-191","descriptions":[{"lang":"en","value":"CAPEC-191 Read Sensitive Constants Within an Executable"}]},{"capecId":"CAPEC-545","descriptions":[{"lang":"en","value":"CAPEC-545 Pull Data from System Resources"}]}],"affected":[{"vendor":"GeoVision Inc.","product":"GV-Face","platforms":["Android"],"packageName":"tw.com.geovision.face","versions":[{"status":"affected","version":"2.2.1"},{"status":"unaffected","version":"2.2.2"}],"defaultStatus":"unaffected"}],"cpeApplicability":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:geovision_inc.:gv-face:2.2.1:*:android:*:*:*:*:*"},{"vulnerable":false,"criteria":"cpe:2.3:a:geovision_inc.:gv-face:2.2.2:*:android:*:*:*:*:*"}]}]}],"descriptions":[{"lang":"en","value":"The RSA cryptographic key material, including a private key and public key, is\nembedded within the application package. Because Android applications can\nbe extracted and reverse engineered, storing private cryptographic keys\ndirectly inside the client application may allow an attacker to recover the\nkeys and potentially use them to impersonate the application, decrypt protected\ndata, or generate unauthorized cryptographic operations.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>The RSA cryptographic key material, including a private key and public key, is\nembedded within the application package.&nbsp;Because Android applications can\nbe extracted and reverse engineered, storing private cryptographic keys\ndirectly inside the client application may allow an attacker to recover the\nkeys and potentially use them to impersonate the application, decrypt protected\ndata, or generate unauthorized cryptographic operations.</p>"}]}],"references":[{"url":"https://dlcdn.geovision.com.tw/TechNotice/CyberSecurity/2026/Security_Advisory_GV-Eye-2026-09-01.pdf"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseSeverity":"MEDIUM","baseScore":6.2,"vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}],"credits":[{"lang":"en","value":"Lloyd Lexter Gealon","type":"finder"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-11-12T17:25:29.230280Z","id":"CVE-2026-124599","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-11-12T17:26:05.083Z"}}]}}