{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-103096", "assignerOrgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "state": "PUBLISHED", "assignerShortName": "GV", "dateReserved": "2026-09-30T02:10:01.725Z", "datePublished": "2026-10-02T00:14:08.149Z", "dateUpdated": "2026-10-02T00:14:08.149Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "shortName": "GV", "dateUpdated": "2026-10-02T00:14:08.149Z"}, "title": "GV-Eye Hardcoded API Key Vulnerability", "datePublic": "2026-09-30T02:15:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-798", "description": "CWE-798: Use of Hard-coded Credentials", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-540", "description": "CWE-540 Inclusion of sensitive information in source code", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-312", "description": "CWE-312 Cleartext storage of sensitive information", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-37", "descriptions": [{"lang": "en", "value": "CAPEC-37 Retrieve Embedded Sensitive Data"}]}, {"capecId": "CAPEC-188", "descriptions": [{"lang": "en", "value": "CAPEC-188 Reverse Engineering"}]}, {"capecId": "CAPEC-618", "descriptions": [{"lang": "en", "value": "CAPEC-618 Cellular Broadcast Message Request"}]}], "affected": [{"vendor": "GeoVision Inc.", "product": "GV-Eye", "platforms": ["Android"], "packageName": "tw.com.geovision.gveye", "versions": [{"status": "affected", "version": "V3.6.0"}, {"status": "unaffected", "version": "V3.7.2"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:geovision_inc.:gv-eye:v3.6.0:*:android:*:*:*:*:*"}, {"vulnerable": false, "criteria": "cpe:2.3:a:geovision_inc.:gv-eye:v3.7.2:*:android:*:*:*:*:*"}]}]}], "descriptions": [{"lang": "en", "value": "API\nkey is hardcoded and retrievable from the application package. Since Android\napplications can be reverse engineered, embedding sensitive API credentials\ndirectly in the client application may allow unauthorized users to extract and\nmisuse the key.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "API\nkey is hardcoded and retrievable from the application package. Since Android\napplications can be reverse engineered, embedding sensitive API credentials\ndirectly in the client application may allow unauthorized users to extract and\nmisuse the key."}]}], "references": [{"url": "https://www.geovision.com.tw/cyber_security.php", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "credits": [{"lang": "en", "value": "Lloyd Lexter Gealon", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "tw.com.geovision.gveye", "platforms": ["Android"], "product": "GV-Eye", "vendor": "GeoVision Inc.", "versions": [{"status": "affected", "version": "V3.6.0"}, {"status": "unaffected", "version": "V3.7.2"}]}], "source": "0df08a0e-a200-4957-9bb0-084f562506f9"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "API\nkey is hardcoded and retrievable from the application package. Since Android\napplications can be reverse engineered, embedding sensitive API credentials\ndirectly in the client application may allow unauthorized users to extract and\nmisuse the key."}], "id": "CVE-2026-103096", "lastModified": "2026-10-02T01:16:42.930", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "0df08a0e-a200-4957-9bb0-084f562506f9", "type": "Secondary"}]}, "published": "2026-10-02T01:16:42.930", "references": [{"source": "0df08a0e-a200-4957-9bb0-084f562506f9", "url": "https://www.geovision.com.tw/cyber_security.php"}], "sourceIdentifier": "0df08a0e-a200-4957-9bb0-084f562506f9", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-312"}, {"lang": "en", "value": "CWE-540"}, {"lang": "en", "value": "CWE-798"}], "source": "0df08a0e-a200-4957-9bb0-084f562506f9", "type": "Secondary"}]}

{}

{"created": "2026-10-02T02:30:18.250253+00:00", "updated": "2026-10-02T02:30:18.250260+00:00", "vendors": []}