CVE-2026-124599— Hardcoded RSA Private Key and Public Key Exposure in GV-Face Android Application v2.2.1

Quick assessment

Affected

GeoVision Inc. GV-Face

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

RSA 加密密钥材料（包括私钥和公钥）被嵌入到应用程序包中。由于 Android 应用程序可被提取并逆向工程，将加密私钥直接存储在客户端应用程序内部，可能使攻击者恢复这些密钥，进而冒充应用程序、解密受保护数据或执行未经授权的加密操作。

CVSS 6.2 · Medium Updated Nov 10, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Hardcoded RSA Private Key and Public Key Exposure in GV-Face Android Application v2.2.1

Source: CVE Program / CVE List V5

Vulnerability Description

The RSA cryptographic key material, including a private key and public key, is embedded within the application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly inside the client application may allow an attacker to recover the keys and potentially use them to impersonate the application, decrypt protected data, or generate unauthorized cryptographic operations.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

使用硬编码的密码学密钥

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
GeoVision Inc.	GV-Face	2.2.1	-

II. Public POCs for CVE-2026-124599

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-124599

请登录查看更多情报信息。

Other References for CVE-2026-124599 (1)

https://dlcdn.geovision.com.tw/TechNotice/CyberSecurity/2026/Security_Advisory_GV-Eye-2026-09-01.pdf

https://www.cve.org/CVERecord?id=CVE-2026-124599

Same Patch Batch · GeoVision Inc. · 2026-11-10 · 7 CVEs total

CVE-2026-124600	10.0 CRITICAL	Unencrypted HTTP Traffic Exposing Sensitive User Credentials in GV-Face Android Applicatio
CVE-2026-124598	7.5 HIGH	Hardcoded API Key Discovered in GV-Face Android Application v2.2.1
CVE-2026-124602	6.2 MEDIUM	Hardcoded RSA Private Key and Public Key Exposure in GV-Access Android Application v1.6.1
CVE-2026-124601	6.2 MEDIUM	Hardcoded API Key Discovered in GV-Access Android Application v1.6.1
CVE-2026-124603	6.2 MEDIUM	Hardcoded API Key Discovered in GV-Cloud Android Application v1.5.1
CVE-2026-124604	6.2 MEDIUM	Hardcoded RSA Private Key and Public Key Exposure in GV-Cloud Android Application v1.5.1

IV. Related Vulnerabilities

Same product: GV-Face

Same vendor: GeoVision Inc.

Same weakness: CWE-321