{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-103096", "assignerOrgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "state": "PUBLISHED", "assignerShortName": "GV", "dateReserved": "2026-09-30T02:10:01.725Z", "datePublished": "2026-10-02T00:14:08.149Z", "dateUpdated": "2026-10-02T19:49:37.251Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "shortName": "GV", "dateUpdated": "2026-10-02T00:14:08.149Z"}, "title": "GV-Eye Hardcoded API Key Vulnerability", "datePublic": "2026-09-30T02:15:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-798", "description": "CWE-798: Use of Hard-coded Credentials", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-540", "description": "CWE-540 Inclusion of sensitive information in source code", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-312", "description": "CWE-312 Cleartext storage of sensitive information", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-37", "descriptions": [{"lang": "en", "value": "CAPEC-37 Retrieve Embedded Sensitive Data"}]}, {"capecId": "CAPEC-188", "descriptions": [{"lang": "en", "value": "CAPEC-188 Reverse Engineering"}]}, {"capecId": "CAPEC-618", "descriptions": [{"lang": "en", "value": "CAPEC-618 Cellular Broadcast Message Request"}]}], "affected": [{"vendor": "GeoVision Inc.", "product": "GV-Eye", "platforms": ["Android"], "packageName": "tw.com.geovision.gveye", "versions": [{"status": "affected", "version": "V3.6.0"}, {"status": "unaffected", "version": "V3.7.2"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:geovision_inc.:gv-eye:v3.6.0:*:android:*:*:*:*:*"}, {"vulnerable": false, "criteria": "cpe:2.3:a:geovision_inc.:gv-eye:v3.7.2:*:android:*:*:*:*:*"}]}]}], "descriptions": [{"lang": "en", "value": "API\nkey is hardcoded and retrievable from the application package. Since Android\napplications can be reverse engineered, embedding sensitive API credentials\ndirectly in the client application may allow unauthorized users to extract and\nmisuse the key.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "API\nkey is hardcoded and retrievable from the application package. Since Android\napplications can be reverse engineered, embedding sensitive API credentials\ndirectly in the client application may allow unauthorized users to extract and\nmisuse the key."}]}], "references": [{"url": "https://www.geovision.com.tw/cyber_security.php", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "credits": [{"lang": "en", "value": "Lloyd Lexter Gealon", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-02T19:49:23.318600Z", "id": "CVE-2026-103096", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-02T19:49:37.251Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-103096", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-02T19:49:23.318600Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-02T19:49:31.540Z"}}], "cna": {"title": "GV-Eye Hardcoded API Key Vulnerability", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Lloyd Lexter Gealon"}], "impacts": [{"capecId": "CAPEC-37", "descriptions": [{"lang": "en", "value": "CAPEC-37 Retrieve Embedded Sensitive Data"}]}, {"capecId": "CAPEC-188", "descriptions": [{"lang": "en", "value": "CAPEC-188 Reverse Engineering"}]}, {"capecId": "CAPEC-618", "descriptions": [{"lang": "en", "value": "CAPEC-618 Cellular Broadcast Message Request"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "GeoVision Inc.", "product": "GV-Eye", "versions": [{"status": "affected", "version": "V3.6.0"}, {"status": "unaffected", "version": "V3.7.2"}], "platforms": ["Android"], "packageName": "tw.com.geovision.gveye", "defaultStatus": "unaffected"}], "datePublic": "2026-09-30T02:15:00.000Z", "references": [{"url": "https://www.geovision.com.tw/cyber_security.php", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "API\nkey is hardcoded and retrievable from the application package. Since Android\napplications can be reverse engineered, embedding sensitive API credentials\ndirectly in the client application may allow unauthorized users to extract and\nmisuse the key.", "supportingMedia": [{"type": "text/html", "value": "API\nkey is hardcoded and retrievable from the application package. Since Android\napplications can be reverse engineered, embedding sensitive API credentials\ndirectly in the client application may allow unauthorized users to extract and\nmisuse the key.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-798", "description": "CWE-798: Use of Hard-coded Credentials"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-540", "description": "CWE-540 Inclusion of sensitive information in source code"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-312", "description": "CWE-312 Cleartext storage of sensitive information"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:geovision_inc.:gv-eye:v3.6.0:*:android:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:geovision_inc.:gv-eye:v3.7.2:*:android:*:*:*:*:*", "vulnerable": false}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "shortName": "GV", "dateUpdated": "2026-10-02T00:14:08.149Z"}}}, "cveMetadata": {"cveId": "CVE-2026-103096", "state": "PUBLISHED", "dateUpdated": "2026-10-02T19:49:37.251Z", "dateReserved": "2026-09-30T02:10:01.725Z", "assignerOrgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "datePublished": "2026-10-02T00:14:08.149Z", "assignerShortName": "GV"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "tw.com.geovision.gveye", "platforms": ["Android"], "product": "GV-Eye", "vendor": "GeoVision Inc.", "versions": [{"status": "affected", "version": "V3.6.0"}, {"status": "unaffected", "version": "V3.7.2"}]}], "source": "0df08a0e-a200-4957-9bb0-084f562506f9"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "API\nkey is hardcoded and retrievable from the application package. Since Android\napplications can be reverse engineered, embedding sensitive API credentials\ndirectly in the client application may allow unauthorized users to extract and\nmisuse the key."}], "id": "CVE-2026-103096", "lastModified": "2026-10-02T20:16:59.723", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "0df08a0e-a200-4957-9bb0-084f562506f9", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-103096", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-02T19:49:23.318600Z", "version": "2.0.3"}}]}, "published": "2026-10-02T01:16:42.930", "references": [{"source": "0df08a0e-a200-4957-9bb0-084f562506f9", "url": "https://www.geovision.com.tw/cyber_security.php"}], "sourceIdentifier": "0df08a0e-a200-4957-9bb0-084f562506f9", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-312"}, {"lang": "en", "value": "CWE-540"}, {"lang": "en", "value": "CWE-798"}], "source": "0df08a0e-a200-4957-9bb0-084f562506f9", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["Android"], "status": "affected", "versions": {"scheme": "generic", "value": "V3.6.0"}}, {"platform": ["Android"], "status": "unaffected", "versions": {"scheme": "generic", "value": "V3.7.2"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}]}, "product": "gv-eye", "vendor": "geovision"}], "created": "2026-10-02T02:30:18.250253+00:00", "updated": "2026-10-02T14:47:04.901388+00:00", "vendors": ["geovision", "geovision$PRODUCT$gv-eye"]}