CVE-2026-124604
Received Received - Intake

Hard-Coded RSA Keys in GV-Cloud Application

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: GV

Description
The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Cloud application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly inside the client application may allow an attacker to recover the keys and potentially use them to impersonate the application, decrypt protected data, or generate unauthorized cryptographic operations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-124604
EUVD
EUVD-2026-120668

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-321 The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves private cryptographic keys being embedded directly within the GV-Cloud Android application package. Since Android apps can be extracted and reverse engineered, attackers could recover these keys and use them to impersonate the app, decrypt data, or perform unauthorized cryptographic operations.

Detection Guidance

This vulnerability involves embedded private keys in an Android application. To detect it, inspect the APK file for hardcoded keys using tools like apktool to decompile the app and search for key files or strings. Check for files named 'private.key' or similar in the extracted resources.

Impact Analysis

An attacker could use the recovered private keys to impersonate the application, decrypt sensitive data, or perform unauthorized cryptographic actions. This could lead to data breaches, unauthorized access, or other malicious activities.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and encryption standards in regulations like GDPR and HIPAA. It risks unauthorized access to sensitive data, which could result in legal penalties and loss of trust.

Mitigation Strategies

Remove embedded private keys from the Android application package and use secure key storage mechanisms like Android Keystore or server-side key management. Rebuild and redistribute the application without hardcoded keys.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124604. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...