{"id":"CVE-2026-124600","kind":"vulnerability","aliases":["CVE-2026-124600"],"related":[],"title":"GV-Face Android app 2.2.1 sends user credentials over unencrypted HTTP","description":"GV-Face transmits sensitive user credentials and\nrelated authentication data over unencrypted HTTP connections. The HTTP\ntraffic is not encrypted, an attacker with the ability to intercept network\ntraffic.","summary":"GV-Face sends login credentials and related authentication data over plain HTTP instead of encrypted HTTPS. An attacker who can intercept network traffic between a user and the service can read those credentials.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"GV-Face","fixed":[],"affected":"2.2.1 (Android app)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","cleartext-http","geovision","gv-face","other"],"not_affected_if":[],"how_to_check":"Check the installed GV-Face Android app version (Settings > Apps > GV-Face); 2.2.1 is the version named in the CVE record. Other versions and iOS are not stated either way. Capturing the app's login traffic on a test network would show whether it uses http:// rather than https://.","fix":null,"status":"open","published_at":"2026-11-10T01:17:18+00:00","first_seen_at":"2026-11-10T01:26:41+00:00","triaged_at":"2026-11-10T01:28:09+00:00","updated_at":"2026-11-10T01:30:41+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T01:28:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"GV-Face: user credentials sent over unencrypted HTTP can be intercepted","impact":"high","summary":"GV-Face sends login credentials and related authentication data over plain HTTP instead of encrypted HTTPS. An attacker who can intercept network traffic between a user and the service can read those credentials.","audience":"businesses","category":"other","nicknames":[],"who_cares":["gv-face"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reads user credentials and authentication data from intercepted traffic","analyst_note":"Find the vendor advisory or NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-124600) to confirm affected GV-Face versions, whether HTTPS is the fix, and whether a setting disables plain HTTP.","how_to_check":"unknown","plain_action":"","product_name":"GV-Face","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000661,"input_tokens":4520,"output_tokens":419,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor advisory or NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-124600) to confirm affected GV-Face versions, whether HTTPS is the fix, and whether a setting disables plain HTTP.","search":"'-124600':15A,18A '-2026':14A,17A '2.2.1':6A 'abil':89C 'android':4A,22B 'app':5A 'attack':48B,86C 'authent':38B,73C 'cleartext':24B 'cleartext-http':23B 'connect':78C 'credenti':9A,35B,63B,70C 'cve':13A,16A 'data':39B,74C 'encrypt':45B,84C 'face':3A,21A,29B,32B,66C 'geovis':26B 'gv':2A,20A,28B,31B,65C 'gv-face':1A,19A,27B,30B,64C 'http':12A,25B,42B,77C,80C 'https':46B 'instead':43B 'intercept':51B,91C 'login':34B 'network':52B,92C 'plain':41B 'read':61B 'relat':37B,72C 'send':7A,33B 'sensit':68C 'servic':59B 'traffic':53B,81C,93C 'transmit':67C 'unencrypt':11A,76C 'user':8A,56B,69C","nicknames":[],"mitigations":[],"who_affected":"People and organisations that use the GeoVision GV-Face Android app, version 2.2.1 per the CVE record, to log in to GeoVision services. Anyone on the same network path (public Wi-Fi, a compromised router) could read the login credentials. Teams that do not use the GV-Face app can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["gvface"],"ptokens":["face","gv"],"labels":["android","cleartexthttp","critical","geovision","gvface","other","vendor"],"campaign_type":null,"search_a":"'-124600':15A,18A '-2026':14A,17A '2.2.1':6A 'android':4A 'app':5A 'credenti':9A 'cve':13A,16A 'face':3A,21A 'gv':2A,20A 'gv-face':1A,19A 'http':12A 'send':7A 'unencrypt':11A 'user':8A","search_b":"'android':22B 'attack':48B 'authent':38B 'cleartext':24B 'cleartext-http':23B 'credenti':35B,63B 'data':39B 'encrypt':45B 'face':29B,32B 'geovis':26B 'gv':28B,31B 'gv-face':27B,30B 'http':25B,42B 'https':46B 'instead':43B 'intercept':51B 'login':34B 'network':52B 'plain':41B 'read':61B 'relat':37B 'send':33B 'servic':59B 'traffic':53B 'user':56B","search_c":"'abil':89C 'attack':86C 'authent':73C 'connect':78C 'credenti':70C 'data':74C 'encrypt':84C 'face':66C 'gv':65C 'gv-face':64C 'http':77C,80C 'intercept':91C 'network':92C 'relat':72C 'sensit':68C 'traffic':81C,93C 'transmit':67C 'unencrypt':76C 'user':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"0df08a0e-a200-4957-9bb0-084f562506f9","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124600","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124600","severity":null,"published_at":"2026-11-10T01:17:18+00:00","modified_at":"2026-11-10T01:17:18+00:00","first_seen_at":"2026-11-10T01:26:41+00:00","fetched_at":"2026-11-10T01:26:41+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124600:2374","url":"https://cve.imfht.com/detail/CVE-2026-124600","severity":null,"published_at":"2026-11-10T01:30:41+00:00","modified_at":"2026-11-10T01:30:41+00:00","first_seen_at":"2026-11-10T01:30:41+00:00","fetched_at":"2026-11-10T01:30:41+00:00","note":"No GeoVision advisory for GV-Face exists yet: the vendor advisory index (checked 2026-11-10) lists none. Affected version 2.2.1 and Android come from a mirror of the CVE List record. No fixed version, no setting to disable HTTP, no PoC, and no exploitation reported. Nothing verified. Revisit when GeoVision publishes an advisory; the sibling GV-Eye Android advisory was fixed in 3.7.2, but that does not apply to GV-Face. The CVSS 10.0 looks high for interception that needs a network position, but I left severity unchanged.","cites":["https://cve.imfht.com/detail/CVE-2026-124600","https://dlcdn.geovision.com.tw/TechNotice/CyberSecurity/Security_Advisory_Index.pdf"]}],"documents":[{"id":112441,"url":"https://cve.imfht.com/detail/CVE-2026-124600","title":"CVE-2026-124600 (mirror of CVE List V5 record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":112442,"url":"https://dlcdn.geovision.com.tw/TechNotice/CyberSecurity/Security_Advisory_Index.pdf","title":"GeoVision Security Advisory Index","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}