{"affected":[{"defaultStatus":"unaffected","packageName":"tw.com.geovision.nativityGvloud","platforms":["Android"],"product":"GV-Cloud","source":"CNA: GV","vendor":"GeoVision Inc.","versions":[{"status":"affected","version":"1.5.1"},{"status":"unaffected","version":"1.5.2"}]}],"cveId":"CVE-2026-124603","cwes":["CWE-798"],"description":"An API key is\nhardcoded and retrievable from the GV-Cloud application package. Since Android\napplications can be reverse engineered, embedding sensitive API credentials\ndirectly in the client application may allow unauthorized users to extract and\nmisuse the key.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.2,"severity":"medium","source":"CNA: GV","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1794270124274,"publishedAt":1794270124274,"references":[{"source":"CNA: GV","tags":[],"url":"https://www.geovision.com.tw/cyber_security.php"}],"remediation":[],"revision":"ada94297f1029f5b2f0ee5415885b0b738bffff618023dbb2740287d65f277a6","sources":[{"modifiedAt":1794270124274,"name":"CNA: GV","retrievedAt":1794272963286,"url":"https://www.cve.org/CVERecord?id=CVE-2026-124603"}],"ssvc":null,"status":"published","title":"Hardcoded API Key Discovered in GV-Cloud Android Application v1.5.1","updatedAt":1794272963286}