{"id":"CVE-2026-124604","kind":"vulnerability","aliases":["CVE-2026-124604"],"related":[],"title":"GV-Cloud Android app: embedded RSA private key lets attackers impersonate it","description":"The RSA cryptographic key\nmaterial, including a private key and public key, is embedded within the GV-Cloud application package. Because Android applications can be extracted and\nreverse engineered, storing private cryptographic keys directly inside the\nclient application may allow an attacker to recover the keys and potentially\nuse them to impersonate the application, decrypt protected data, or generate\nunauthorized cryptographic operations.","summary":"The GV-Cloud Android application package contains an RSA private and public key pair. An attacker who extracts and reverse engineers the app can recover the private key and use it to impersonate the app, decrypt protected data, or perform unauthorized cryptographic operations.","severity":"medium","cvss":6.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","gv-cloud","mobile","other"],"not_affected_if":["app-not-installed"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T01:17:19+00:00","first_seen_at":"2026-11-10T01:26:41+00:00","triaged_at":"2026-11-10T01:28:49+00:00","updated_at":"2026-11-10T01:28:49+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T01:28:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"GV-Cloud Android app: embedded RSA private key lets attackers impersonate it","impact":"medium","summary":"The GV-Cloud Android application package contains an RSA private and public key pair. An attacker who extracts and reverse engineers the app can recover the private key and use it to impersonate the app, decrypt protected data, or perform unauthorized cryptographic operations.","audience":"everyone","category":"other","nicknames":[],"who_cares":["android","gv-cloud","mobile"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker recovers private key and impersonates the application","analyst_note":"Find the affected GV-Cloud Android versions and the vendor's fix status at https://nvd.nist.gov/vuln/detail/CVE-2026-124604.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["app-not-installed"],"who_is_affected":"Affects the GV-Cloud Android app, whose package ships a hardcoded RSA private key. The sources do not name affected versions or say whether a fix exists, so the team running GV-Cloud should check with the vendor. Anyone who does not use the GV-Cloud Android app is not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000703,"input_tokens":4578,"output_tokens":490,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124604':15A,18A '-2026':14A,17A 'allow':108C 'android':4A,19B,28B,90C 'app':5A,47B,59B 'applic':29B,87C,91C,106C,122C 'attack':11A,40B,110C 'client':105C 'cloud':3A,22B,27B,86C 'contain':31B 'cryptograph':66B,70C,100C,129C 'cve':13A,16A 'data':62B,125C 'decrypt':60B,123C 'direct':102C 'embed':6A,81C 'engin':45B,97C 'extract':42B,94C 'generat':127C 'gv':2A,21B,26B,85C 'gv-cloud':1A,20B,25B,84C 'imperson':12A,57B,120C 'includ':73C 'insid':103C 'key':9A,37B,52B,71C,76C,79C,101C,114C 'let':10A 'materi':72C 'may':107C 'mobil':23B 'oper':67B,130C 'packag':30B,88C 'pair':38B 'perform':64B 'potenti':116C 'privat':8A,34B,51B,75C,99C 'protect':61B,124C 'public':36B,78C 'recov':49B,112C 'revers':44B,96C 'rsa':7A,33B,69C 'store':98C 'unauthor':65B,128C 'use':54B,117C 'within':82C","nicknames":[],"mitigations":[],"who_affected":"Affects the GV-Cloud Android app, whose package ships a hardcoded RSA private key. The sources do not name affected versions or say whether a fix exists, so the team running GV-Cloud should check with the vendor. Anyone who does not use the GV-Cloud Android app is not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","gvcloud","medium","mobile","other"],"campaign_type":null,"search_a":"'-124604':15A,18A '-2026':14A,17A 'android':4A 'app':5A 'attack':11A 'cloud':3A 'cve':13A,16A 'embed':6A 'gv':2A 'gv-cloud':1A 'imperson':12A 'key':9A 'let':10A 'privat':8A 'rsa':7A","search_b":"'android':19B,28B 'app':47B,59B 'applic':29B 'attack':40B 'cloud':22B,27B 'contain':31B 'cryptograph':66B 'data':62B 'decrypt':60B 'engin':45B 'extract':42B 'gv':21B,26B 'gv-cloud':20B,25B 'imperson':57B 'key':37B,52B 'mobil':23B 'oper':67B 'packag':30B 'pair':38B 'perform':64B 'privat':34B,51B 'protect':61B 'public':36B 'recov':49B 'revers':44B 'rsa':33B 'unauthor':65B 'use':54B","search_c":"'allow':108C 'android':90C 'applic':87C,91C,106C,122C 'attack':110C 'client':105C 'cloud':86C 'cryptograph':70C,100C,129C 'data':125C 'decrypt':123C 'direct':102C 'embed':81C 'engin':97C 'extract':94C 'generat':127C 'gv':85C 'gv-cloud':84C 'imperson':120C 'includ':73C 'insid':103C 'key':71C,76C,79C,101C,114C 'materi':72C 'may':107C 'oper':130C 'packag':88C 'potenti':116C 'privat':75C,99C 'protect':124C 'public':78C 'recov':112C 'revers':96C 'rsa':69C 'store':98C 'unauthor':128C 'use':117C 'within':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"0df08a0e-a200-4957-9bb0-084f562506f9","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124604","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124604","severity":null,"published_at":"2026-11-10T01:17:19+00:00","modified_at":"2026-11-10T01:17:19+00:00","first_seen_at":"2026-11-10T01:26:41+00:00","fetched_at":"2026-11-10T01:26:41+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}