Encryption Flaw in LaserGest Mobile Application by LaserGest
CVE-2026-112164

6.6MEDIUM

Key Information:

Vendor

Laservideo

Status
Lasergest
Vendor
CVE Published:
9 November 2026

What is CVE-2026-112164?

The LaserGest mobile application has a significant security flaw that involves the storage of assistance portal credentials using a hardcoded AES encryption key and initialization vector (IV). This design choice creates a critical risk, as an attacker gaining access to the application package can easily extract these credentials in plaintext. This vulnerability underlines the importance of employing dynamic key management practices to safeguard sensitive information.

Affected Version(s)

lasergest iOS 1.0.18

References

https://github.com/livieromarco/security-advisories/blob/...
technical-description

CVSS V4

Score:
6.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Liviero Marco
CSIRT-IT
.