CVE-2026-124602— Hardcoded RSA Private Key and Public Key Exposure in GV-Access Android Application v1.6.1

Quick assessment

Affected

GeoVision Inc. GV-Access

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

RSA 加密密钥材料（包括私钥和公钥）被嵌入在 GV-Access 应用程序包中。由于 Android 应用程序可被提取并进行逆向工程，将加密私钥直接存储在客户端应用程序内，可能使攻击者能够恢复这些密钥，进而利用它们冒充该应用程序、解密受保护的数据，或生成未经授权的加密操作。

CVSS 6.2 · Medium Updated Nov 10, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Hardcoded RSA Private Key and Public Key Exposure in GV-Access Android Application v1.6.1

Source: CVE Program / CVE List V5

Vulnerability Description

The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Access application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly inside the client application may allow an attacker to recover the keys and potentially use them to impersonate the application, decrypt protected data, or generate unauthorized cryptographic operations.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

使用硬编码的密码学密钥

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
GeoVision Inc.	GV-Access	1.6.1	-

II. Public POCs for CVE-2026-124602

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-124602

请登录查看更多情报信息。

Vendor Pages for CVE-2026-124602 (1)

🔗 Cyber Security - GeoVision Read full article

https://www.cve.org/CVERecord?id=CVE-2026-124602

Same Patch Batch · GeoVision Inc. · 2026-11-10 · 7 CVEs total

CVE-2026-124600	10.0 CRITICAL	Unencrypted HTTP Traffic Exposing Sensitive User Credentials in GV-Face Android Applicatio
CVE-2026-124598	7.5 HIGH	Hardcoded API Key Discovered in GV-Face Android Application v2.2.1
CVE-2026-124601	6.2 MEDIUM	Hardcoded API Key Discovered in GV-Access Android Application v1.6.1
CVE-2026-124603	6.2 MEDIUM	Hardcoded API Key Discovered in GV-Cloud Android Application v1.5.1
CVE-2026-124604	6.2 MEDIUM	Hardcoded RSA Private Key and Public Key Exposure in GV-Cloud Android Application v1.5.1
CVE-2026-124599	6.2 MEDIUM	Hardcoded RSA Private Key and Public Key Exposure in GV-Face Android Application v2.2.1

IV. Related Vulnerabilities

Same product: GV-Access

CVE-2026-124601
Hardcoded API Key Discovered in GV-Access Android Applicatio

Same vendor: GeoVision Inc.

Same weakness: CWE-321