{"id":"CVE-2026-103097","state":"PUBLISHED","title":"GV-Eye Relay Payment API Key Vulnerability","description":"An API key is\nhardcoded and retrievable from the application package. Since Android\napplications can be reverse engineered, embedding sensitive API credentials\ndirectly in the client application may allow unauthorized users to extract and\nmisuse the key.","publishedAt":"2026-10-02T00:14:46.555Z","updatedAt":"2026-10-02T19:51:12.038Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"GV"},"assigner":"GV","products":["GeoVision Inc. GV-Eye"],"affected":[{"vendor":"GeoVision Inc.","product":"GV-Eye","packageName":"tw.com.geovision.gveye","defaultStatus":"unaffected","versions":[{"version":"V3.6.0","status":"affected"},{"version":"V3.7.2","status":"unaffected"}],"platforms":["Android"]}],"references":["https://www.geovision.com.tw/cyber_security.php"],"weaknesses":["CWE-798","CWE-540","CWE-312"],"ingestedAt":"2026-10-29T20:10:23.711Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/103xxx/CVE-2026-103097.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-103097","state":"PUBLISHED","datePublished":"2026-10-02T00:14:46.555Z","dateUpdated":"2026-10-02T19:51:12.038Z","assignerShortName":"GV","assignerOrgId":"0df08a0e-a200-4957-9bb0-084f562506f9","dateReserved":"2026-09-30T02:10:01.788Z"},"containers":{"cna":{"title":"GV-Eye Relay Payment API Key Vulnerability","descriptions":[{"lang":"en","value":"An API key is\nhardcoded and retrievable from the application package. Since Android\napplications can be reverse engineered, embedding sensitive API credentials\ndirectly in the client application may allow unauthorized users to extract and\nmisuse the key."}],"affected":[{"vendor":"GeoVision Inc.","product":"GV-Eye","packageName":"tw.com.geovision.gveye","defaultStatus":"unaffected","versions":[{"version":"V3.6.0","status":"affected"},{"version":"V3.7.2","status":"unaffected"}],"platforms":["Android"]}],"references":[{"url":"https://www.geovision.com.tw/cyber_security.php","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseSeverity":"HIGH","baseScore":7.5,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-798","lang":"en","description":"CWE-798: Use of Hard-coded Credentials","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-540","lang":"en","description":"CWE-540 Inclusion of sensitive information in source code","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-312","lang":"en","description":"CWE-312 Cleartext storage of sensitive information","type":"CWE"}]}],"providerMetadata":{"shortName":"GV","orgId":"0df08a0e-a200-4957-9bb0-084f562506f9","dateUpdated":"2026-10-02T00:14:46.555Z"},"datePublic":"2026-09-30T02:15:00.000Z","impacts":[{"capecId":"CAPEC-37","descriptions":[{"lang":"en","value":"CAPEC-37 Retrieve Embedded Sensitive Data"}]},{"capecId":"CAPEC-188","descriptions":[{"lang":"en","value":"CAPEC-188 Reverse Engineering"}]},{"capecId":"CAPEC-618","descriptions":[{"lang":"en","value":"CAPEC-618 Cellular Broadcast Message Request"}]}],"cpeApplicability":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:geovision_inc.:gv-eye:v3.6.0:*:android:*:*:*:*:*"},{"vulnerable":false,"criteria":"cpe:2.3:a:geovision_inc.:gv-eye:v3.7.2:*:android:*:*:*:*:*"}]}]}],"credits":[{"lang":"en","value":"Lloyd Lexter Gealon","type":"finder"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-02T19:50:50.311900Z","id":"CVE-2026-103097","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-02T19:51:12.038Z"}}]}}}