CVE-2026-124602
Received Received - Intake

GV-Access App Embedded RSA Private Key Exposure

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: GV

Description
The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Access application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly inside the client application may allow an attacker to recover the keys and potentially use them to impersonate the application, decrypt protected data, or generate unauthorized cryptographic operations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-124602
EUVD
EUVD-2026-120671

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
geovision gv-access *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-321 The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves private cryptographic keys being embedded directly within the GV-Access Android application. Since Android apps can be reverse engineered, attackers could extract these keys and use them to impersonate the app, decrypt sensitive data, or perform unauthorized cryptographic operations.

Detection Guidance

This vulnerability involves embedded private keys in an Android application. To detect it, inspect the APK file for hardcoded keys using tools like apktool to decompile the app and search for key material in the code or resources.

Impact Analysis

If exploited, this vulnerability could allow attackers to decrypt protected data, impersonate the application, or generate unauthorized cryptographic operations. This may lead to unauthorized access to sensitive information or misuse of the application's identity.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection standards like GDPR and HIPAA, which mandate secure handling of sensitive data. Unauthorized access to encrypted data could result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Remove embedded private keys from the application and use secure key storage mechanisms like Android Keystore. Rebuild and redistribute the app with updated cryptographic practices.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124602. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...