{"affected":[{"defaultStatus":"unaffected","packageName":"tw.com.geovision.face","platforms":["Android"],"product":"GV-Face","source":"CNA: GV","vendor":"GeoVision Inc.","versions":[{"status":"affected","version":"2.2.1"},{"status":"unaffected","version":"2.2.2"}]}],"cveId":"CVE-2026-124599","cwes":["CWE-321"],"description":"The RSA cryptographic key material, including a private key and public key, is\nembedded within the application package. Because Android applications can\nbe extracted and reverse engineered, storing private cryptographic keys\ndirectly inside the client application may allow an attacker to recover the\nkeys and potentially use them to impersonate the application, decrypt protected\ndata, or generate unauthorized cryptographic operations.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.2,"severity":"medium","source":"CNA: GV","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1794270071810,"publishedAt":1794270071810,"references":[{"source":"CNA: GV","tags":[],"url":"https://dlcdn.geovision.com.tw/TechNotice/CyberSecurity/2026/Security_Advisory_GV-Eye-2026-09-01.pdf"}],"remediation":[],"revision":"011f049f8b4d988056a49d9bf4431879afd1e0575b1a0b10e99299c5a445391c","sources":[{"modifiedAt":1794270071810,"name":"CNA: GV","retrievedAt":1794272958800,"url":"https://www.cve.org/CVERecord?id=CVE-2026-124599"}],"ssvc":null,"status":"published","title":"Hardcoded RSA Private Key and Public Key Exposure in GV-Face Android Application v2.2.1","updatedAt":1794272958800}