Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for GV-Cloud by GeoVision Inc.

    CVE-2026-124603 (GCVE-0-2026-124603)

    Vulnerability from cvelistv5 – Published: 2026-11-10 00:22 – Updated: 2026-11-10 00:22
    VLAI
    Title
    Hardcoded API Key Discovered in GV-Cloud Android Application v1.5.1
    Summary
    An API key is hardcoded and retrievable from the GV-Cloud application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.
    Severity
    6.2 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    CWE
    • CWE-798 - – Use of Hard-coded Credentials
    Assigner
    GV CNA
    References
    Impacted products
    Vendor Product Version
    GeoVision Inc. GV-Cloud Affected: 1.5.1
    Unaffected: 1.5.2
        cpe:2.3:a:geovision_inc.:gv-cloud:1.5.1:*:android:*:*:*:*:*
    		Create a notification for this product.
    Date Public
    2026-11-09 02:43
    Credits
    Lloyd Lexter Gealon
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "tw.com.geovision.nativityGvloud",
          "platforms": [
            "Android"
          ],
          "product": "GV-Cloud",
          "vendor": "GeoVision Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "1.5.1"
            },
            {
              "status": "unaffected",
              "version": "1.5.2"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:geovision_inc.:gv-cloud:1.5.1:*:android:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:geovision_inc.:gv-cloud:1.5.2:*:android:*:*:*:*:*",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Lloyd Lexter Gealon"
        }
      ],
      "datePublic": "2026-11-09T02:43:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn API key is\nhardcoded and retrievable from the GV-Cloud application package. Since Android\napplications can be reverse engineered, embedding sensitive API credentials\ndirectly in the client application may allow unauthorized users to extract and\nmisuse the key.\u003c/p\u003e"
            }
          ],
          "value": "An API key is\nhardcoded and retrievable from the GV-Cloud application package. Since Android\napplications can be reverse engineered, embedding sensitive API credentials\ndirectly in the client application may allow unauthorized users to extract and\nmisuse the key."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-37",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-37 Retrieve Embedded Sensitive Data"
            }
          ]
        },
        {
          "capecId": "CAPEC-191",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-191 Read Sensitive Constants Within an Executable"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-798",
              "description": "CWE-798 \u2013 Use of Hard-coded Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T00:22:04.274Z",
        "orgId": "0df08a0e-a200-4957-9bb0-084f562506f9",
        "shortName": "GV"
      },
      "references": [
        {
          "url": "https://www.geovision.com.tw/cyber_security.php"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Hardcoded API Key Discovered in GV-Cloud Android Application v1.5.1",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0df08a0e-a200-4957-9bb0-084f562506f9",
    "assignerShortName": "GV",
    "cveId": "CVE-2026-124603",
    "datePublished": "2026-11-10T00:22:04.274Z",
    "dateReserved": "2026-11-09T01:42:46.616Z",
    "dateUpdated": "2026-11-10T00:22:04.274Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-124604 (GCVE-0-2026-124604)

    Vulnerability from cvelistv5 – Published: 2026-11-10 00:21 – Updated: 2026-11-10 00:21
    VLAI
    Title
    Hardcoded RSA Private Key and Public Key Exposure in GV-Cloud Android Application v1.5.1
    Summary
    The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Cloud application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly inside the client application may allow an attacker to recover the keys and potentially use them to impersonate the application, decrypt protected data, or generate unauthorized cryptographic operations.
    Severity
    6.2 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    CWE
    • CWE-321 - Use of hard-coded cryptographic key
    Assigner
    GV CNA
    References
    Impacted products
    Vendor Product Version
    GeoVision Inc. GV-Cloud Affected: 1.5.1
    Unaffected: 1.5.2
        cpe:2.3:a:geovision_inc.:gv-cloud:1.5.1:*:android:*:*:*:*:*
    		Create a notification for this product.
    Date Public
    2026-11-09 00:20
    Credits
    Lloyd Lexter Gealon
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "tw.com.geovision.nativityGvloud",
          "platforms": [
            "Android"
          ],
          "product": "GV-Cloud",
          "vendor": "GeoVision Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "1.5.1"
            },
            {
              "status": "unaffected",
              "version": "1.5.2"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:geovision_inc.:gv-cloud:1.5.1:*:android:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:geovision_inc.:gv-cloud:1.5.2:*:android:*:*:*:*:*",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Lloyd Lexter Gealon"
        }
      ],
      "datePublic": "2026-11-09T00:20:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe RSA\u0026nbsp;cryptographic key\nmaterial, including a private key and public key, is embedded within the GV-Cloud application package.\u0026nbsp;Because Android applications can be extracted and\nreverse engineered, storing private cryptographic keys directly inside the\nclient application may allow an attacker to recover the keys and potentially\nuse them to impersonate the application, decrypt protected data, or generate\nunauthorized cryptographic operations.\u003c/p\u003e"
            }
          ],
          "value": "The RSA\u00a0cryptographic key\nmaterial, including a private key and public key, is embedded within the GV-Cloud application package.\u00a0Because Android applications can be extracted and\nreverse engineered, storing private cryptographic keys directly inside the\nclient application may allow an attacker to recover the keys and potentially\nuse them to impersonate the application, decrypt protected data, or generate\nunauthorized cryptographic operations."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-37",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-37 Retrieve Embedded Sensitive Data"
            }
          ]
        },
        {
          "capecId": "CAPEC-191",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-191 Read Sensitive Constants Within an Executable"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-321",
              "description": "CWE-321 Use of hard-coded cryptographic key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T00:21:50.561Z",
        "orgId": "0df08a0e-a200-4957-9bb0-084f562506f9",
        "shortName": "GV"
      },
      "references": [
        {
          "url": "https://www.geovision.com.tw/cyber_security.php"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Hardcoded RSA Private Key and Public Key Exposure in GV-Cloud Android Application v1.5.1",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0df08a0e-a200-4957-9bb0-084f562506f9",
    "assignerShortName": "GV",
    "cveId": "CVE-2026-124604",
    "datePublished": "2026-11-10T00:21:50.561Z",
    "dateReserved": "2026-11-09T01:42:46.616Z",
    "dateUpdated": "2026-11-10T00:21:50.561Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}