CVE-2026-124602

Full vulnerability record from the local CVENow database.

Description

The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Access application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly inside the client application may allow an attacker to recover the keys and potentially use them to impersonate the application, decrypt protected data, or generate unauthorized cryptographic operations.

Severity

MEDIUM

CVSS score

6.2 (v3.1)

Vulnerability status

Received

Source identifier

0df08a0e-a200-4957-9bb0-084f562506f9

Published

2026-11-10 01:17:18.770000

Last modified

2026-11-10 01:17:18.770000

View original CVE JSON

{
  "id": "CVE-2026-124602",
  "sourceIdentifier": "0df08a0e-a200-4957-9bb0-084f562506f9",
  "published": "2026-11-10T01:17:18.770",
  "lastModified": "2026-11-10T01:17:18.770",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The RSA cryptographic\nkey material, including a private key and public key, is embedded within the GV-Access application package. Because Android applications can be extracted and\nreverse engineered, storing private cryptographic keys directly inside the\nclient application may allow an attacker to recover the keys and potentially\nuse them to impersonate the application, decrypt protected data, or generate\nunauthorized cryptographic operations."
    }
  ],
  "affected": [
    {
      "source": "0df08a0e-a200-4957-9bb0-084f562506f9",
      "affectedData": [
        {
          "vendor": "GeoVision Inc.",
          "product": "GV-Access",
          "defaultStatus": "unaffected",
          "packageName": "tw.com.geovision.gvaccesscontrol",
          "platforms": [
            "Android"
          ],
          "versions": [
            {
              "version": "1.6.1",
              "status": "affected"
            },
            {
              "version": "1.6.2",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "0df08a0e-a200-4957-9bb0-084f562506f9",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 6.2,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 3.6
      }
    ]
  },
  "weaknesses": [
    {
      "source": "0df08a0e-a200-4957-9bb0-084f562506f9",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-321"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.geovision.com.tw/cyber_security.php",
      "source": "0df08a0e-a200-4957-9bb0-084f562506f9"
    }
  ]
}