CVE-2026-124599

Full vulnerability record from the local CVENow database.

Description

The RSA cryptographic key material, including a private key and public key, is embedded within the application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly inside the client application may allow an attacker to recover the keys and potentially use them to impersonate the application, decrypt protected data, or generate unauthorized cryptographic operations.

Severity

MEDIUM

CVSS score

6.2 (v3.1)

Vulnerability status

Received

Source identifier

0df08a0e-a200-4957-9bb0-084f562506f9

Published

2026-11-10 01:17:18.333000

Last modified

2026-11-10 01:17:18.333000

View original CVE JSON

{
  "id": "CVE-2026-124599",
  "sourceIdentifier": "0df08a0e-a200-4957-9bb0-084f562506f9",
  "published": "2026-11-10T01:17:18.333",
  "lastModified": "2026-11-10T01:17:18.333",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The RSA cryptographic key material, including a private key and public key, is\nembedded within the application package. Because Android applications can\nbe extracted and reverse engineered, storing private cryptographic keys\ndirectly inside the client application may allow an attacker to recover the\nkeys and potentially use them to impersonate the application, decrypt protected\ndata, or generate unauthorized cryptographic operations."
    }
  ],
  "affected": [
    {
      "source": "0df08a0e-a200-4957-9bb0-084f562506f9",
      "affectedData": [
        {
          "vendor": "GeoVision Inc.",
          "product": "GV-Face",
          "defaultStatus": "unaffected",
          "packageName": "tw.com.geovision.face",
          "platforms": [
            "Android"
          ],
          "versions": [
            {
              "version": "2.2.1",
              "status": "affected"
            },
            {
              "version": "2.2.2",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "0df08a0e-a200-4957-9bb0-084f562506f9",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 6.2,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 3.6
      }
    ]
  },
  "weaknesses": [
    {
      "source": "0df08a0e-a200-4957-9bb0-084f562506f9",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-321"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://dlcdn.geovision.com.tw/TechNotice/CyberSecurity/2026/Security_Advisory_GV-Eye-2026-09-01.pdf",
      "source": "0df08a0e-a200-4957-9bb0-084f562506f9"
    }
  ]
}