by Kastro
Paper/Archive/CVE-2026-124600

CVE-2026-124600

GeoVision Inc. GV-Face — Unencrypted HTTP Traffic Exposing Sensitive User Credentials in GV-Face Android Application v2.2.1

CVSS 10.0
critical.is priorityof 100
30
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0No EPSS score.000 × 200.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

GV-Face transmits sensitive user credentials and related authentication data over unencrypted HTTP connections. The HTTP traffic is not encrypted, an attacker with the ability to intercept network traffic.

Affected

ProductAffectedFixed inSource
GV-Face2.2.12.2.2CNA

Scores by source

GV (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

refdlcdn.geovision.com.tw/TechNotice/CyberSecurity/2026/Security_Advisory_GV-Eye-2026-09-01.pdf