CVE-2026-112164: Hardcoded AES Key Enables Credential Disclosure

Published Nov 9, 2026

Updated

The LaserGest mobile application encrypts stored assistance portal credentials with a hardcoded AES key and IV, allowing an attacker with access to the application package to recover them in cleartext.

Event History

Nov 9, 2026

CVE Published

via MITRE·04:12 PM

Data Sourced

via MITRE·04:12 PM

DescriptionWeakness

Frequently Asked Questions

What access does an attacker need to recover the stored credentials?

The attacker needs access to the LaserGest application package. The hardcoded AES key and IV can then be used to decrypt the stored assistance portal credentials in cleartext.

Which credentials are exposed?

The affected credentials are those stored by the application for the assistance portal.

CVE-2026-112164: Hardcoded AES Key Enables Credential Disclosure

Event History

Frequently Asked Questions

What access does an attacker need to recover the stored credentials?

Which credentials are exposed?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to recover the stored credentials?

Which credentials are exposed?