Search

Find a vulnerability

Search criteria

    3 vulnerabilities found for GV-Face by GeoVision Inc.

    CVE-2026-124600 (GCVE-0-2026-124600)

    Vulnerability from cvelistv5 – Published: 2026-11-10 00:21 – Updated: 2026-11-10 00:21
    VLAI
    Title
    Unencrypted HTTP Traffic Exposing Sensitive User Credentials in GV-Face Android Application v2.2.1
    Summary
    GV-Face transmits sensitive user credentials and related authentication data over unencrypted HTTP connections. The HTTP traffic is not encrypted, an attacker with the ability to intercept network traffic.
    Severity
    10 (Critical)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
    CWE
    • CWE-319 - Cleartext transmission of sensitive information
    Assigner
    GV CNA
    References
    Impacted products
    Vendor Product Version
    GeoVision Inc. GV-Face Affected: 2.2.1
    Unaffected: 2.2.2
        cpe:2.3:a:geovision_inc.:gv-face:2.2.1:*:android:*:*:*:*:*
    		Create a notification for this product.
    Date Public
    2026-11-09 02:04
    Credits
    Lloyd Lexter Gealon
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": ": tw.com.geovision.face",
          "platforms": [
            "Android"
          ],
          "product": "GV-Face",
          "vendor": "GeoVision Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "2.2.1"
            },
            {
              "status": "unaffected",
              "version": "2.2.2"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:geovision_inc.:gv-face:2.2.1:*:android:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:geovision_inc.:gv-face:2.2.2:*:android:*:*:*:*:*",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Lloyd Lexter Gealon"
        }
      ],
      "datePublic": "2026-11-09T02:04:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eGV-Face transmits sensitive user credentials and\nrelated authentication data over unencrypted HTTP connections.\u0026nbsp;The HTTP\ntraffic is not encrypted, an attacker with the ability to intercept network\ntraffic.\u003c/p\u003e"
            }
          ],
          "value": "GV-Face transmits sensitive user credentials and\nrelated authentication data over unencrypted HTTP connections.\u00a0The HTTP\ntraffic is not encrypted, an attacker with the ability to intercept network\ntraffic."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-157",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-157 Sniffing Attacks"
            }
          ]
        },
        {
          "capecId": "CAPEC-94",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-94 Adversary in the Middle (AiTM)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-319",
              "description": "CWE-319 Cleartext transmission of sensitive information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T00:21:14.193Z",
        "orgId": "0df08a0e-a200-4957-9bb0-084f562506f9",
        "shortName": "GV"
      },
      "references": [
        {
          "url": "https://dlcdn.geovision.com.tw/TechNotice/CyberSecurity/2026/Security_Advisory_GV-Eye-2026-09-01.pdf"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Unencrypted HTTP Traffic Exposing Sensitive User Credentials in GV-Face Android Application v2.2.1",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0df08a0e-a200-4957-9bb0-084f562506f9",
    "assignerShortName": "GV",
    "cveId": "CVE-2026-124600",
    "datePublished": "2026-11-10T00:21:14.193Z",
    "dateReserved": "2026-11-09T01:42:46.616Z",
    "dateUpdated": "2026-11-10T00:21:14.193Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-124599 (GCVE-0-2026-124599)

    Vulnerability from cvelistv5 – Published: 2026-11-10 00:21 – Updated: 2026-11-10 00:21
    VLAI
    Title
    Hardcoded RSA Private Key and Public Key Exposure in GV-Face Android Application v2.2.1
    Summary
    The RSA cryptographic key material, including a private key and public key, is embedded within the application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly inside the client application may allow an attacker to recover the keys and potentially use them to impersonate the application, decrypt protected data, or generate unauthorized cryptographic operations.
    Severity
    6.2 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    CWE
    • CWE-321 - Use of hard-coded cryptographic key
    Assigner
    GV CNA
    References
    Impacted products
    Vendor Product Version
    GeoVision Inc. GV-Face Affected: 2.2.1
    Unaffected: 2.2.2
        cpe:2.3:a:geovision_inc.:gv-face:2.2.1:*:android:*:*:*:*:*
    		Create a notification for this product.
    Date Public
    2026-11-09 02:00
    Credits
    Lloyd Lexter Gealon
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "tw.com.geovision.face",
          "platforms": [
            "Android"
          ],
          "product": "GV-Face",
          "vendor": "GeoVision Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "2.2.1"
            },
            {
              "status": "unaffected",
              "version": "2.2.2"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:geovision_inc.:gv-face:2.2.1:*:android:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:geovision_inc.:gv-face:2.2.2:*:android:*:*:*:*:*",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Lloyd Lexter Gealon"
        }
      ],
      "datePublic": "2026-11-09T02:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe RSA cryptographic key material, including a private key and public key, is\nembedded within the application package.\u0026nbsp;Because Android applications can\nbe extracted and reverse engineered, storing private cryptographic keys\ndirectly inside the client application may allow an attacker to recover the\nkeys and potentially use them to impersonate the application, decrypt protected\ndata, or generate unauthorized cryptographic operations.\u003c/p\u003e"
            }
          ],
          "value": "The RSA cryptographic key material, including a private key and public key, is\nembedded within the application package.\u00a0Because Android applications can\nbe extracted and reverse engineered, storing private cryptographic keys\ndirectly inside the client application may allow an attacker to recover the\nkeys and potentially use them to impersonate the application, decrypt protected\ndata, or generate unauthorized cryptographic operations."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-37",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-37 Retrieve Embedded Sensitive Data"
            }
          ]
        },
        {
          "capecId": "CAPEC-191",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-191 Read Sensitive Constants Within an Executable"
            }
          ]
        },
        {
          "capecId": "CAPEC-545",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-545 Pull Data from System Resources"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-321",
              "description": "CWE-321 Use of hard-coded cryptographic key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T00:21:11.810Z",
        "orgId": "0df08a0e-a200-4957-9bb0-084f562506f9",
        "shortName": "GV"
      },
      "references": [
        {
          "url": "https://dlcdn.geovision.com.tw/TechNotice/CyberSecurity/2026/Security_Advisory_GV-Eye-2026-09-01.pdf"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Hardcoded RSA Private Key and Public Key Exposure in GV-Face Android Application v2.2.1",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0df08a0e-a200-4957-9bb0-084f562506f9",
    "assignerShortName": "GV",
    "cveId": "CVE-2026-124599",
    "datePublished": "2026-11-10T00:21:11.810Z",
    "dateReserved": "2026-11-09T01:42:46.616Z",
    "dateUpdated": "2026-11-10T00:21:11.810Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-124598 (GCVE-0-2026-124598)

    Vulnerability from cvelistv5 – Published: 2026-11-10 00:18 – Updated: 2026-11-10 00:18
    VLAI
    Title
    Hardcoded API Key Discovered in GV-Face Android Application v2.2.1
    Summary
    An API key is hardcoded and retrievable from the GV-Face package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    CWE
    • CWE-321 - Use of hard-coded cryptographic key
    Assigner
    GV CNA
    References
    Impacted products
    Vendor Product Version
    GeoVision Inc. GV-Face Affected: 2.2.1
    Unaffected: 2.2.2
        cpe:2.3:a:geovision_inc.:gv-face:2.2.1:*:*:*:*:*:*:*
    		Create a notification for this product.
    Date Public
    2026-11-09 01:55
    Credits
    Lloyd Lexter Gealon
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "tw.com.geovision.face",
          "product": "GV-Face",
          "vendor": "GeoVision Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "2.2.1"
            },
            {
              "status": "unaffected",
              "version": "2.2.2"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:geovision_inc.:gv-face:2.2.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:geovision_inc.:gv-face:2.2.2:*:*:*:*:*:*:*",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Lloyd Lexter Gealon"
        }
      ],
      "datePublic": "2026-11-09T01:55:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn\nAPI key is hardcoded and retrievable from the GV-Face package. Since\nAndroid applications can be reverse engineered, embedding sensitive API\ncredentials directly in the client application may allow unauthorized users to\nextract and misuse the key.\u003c/p\u003e"
            }
          ],
          "value": "An\nAPI key is hardcoded and retrievable from the GV-Face package. Since\nAndroid applications can be reverse engineered, embedding sensitive API\ncredentials directly in the client application may allow unauthorized users to\nextract and misuse the key."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-37",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-37 Retrieve Embedded Sensitive Data"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-321",
              "description": "CWE-321 Use of hard-coded cryptographic key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T00:18:17.969Z",
        "orgId": "0df08a0e-a200-4957-9bb0-084f562506f9",
        "shortName": "GV"
      },
      "references": [
        {
          "url": "https://www.geovision.com.tw/cyber_security.php"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Hardcoded API Key Discovered in GV-Face Android Application v2.2.1",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0df08a0e-a200-4957-9bb0-084f562506f9",
    "assignerShortName": "GV",
    "cveId": "CVE-2026-124598",
    "datePublished": "2026-11-10T00:18:17.969Z",
    "dateReserved": "2026-11-09T01:42:46.616Z",
    "dateUpdated": "2026-11-10T00:18:17.969Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}