CVE-2026-124603

MEDIUM 6.2

Hardcoded API Key Discovered in GV-Cloud Android Application v1.5.1

CVSS Score

6.2

EPSS Score

0.0%

EPSS Percentile

0th

An API key is hardcoded and retrievable from the GV-Cloud application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.

CWE	CWE-798
Vendor	geovision inc.
Product	gv-cloud
Published	Nov 10, 2026

Stay Ahead of the Next One

Get instant alerts for geovision inc. gv-cloud

Be the first to know when new medium vulnerabilities affecting geovision inc. gv-cloud are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

GeoVision Inc. / GV-Cloud

1.5.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

geovision.com.tw: https://www.geovision.com.tw/cyber_security.php

Credits

Lloyd Lexter Gealon