EUVD-2026-91146
GHSA-p7gq-p6v3-22xp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDownload public GV-Eye APK
-
ExploitDecompile and extract hardcoded API key
-
ImpactReplay key against backend service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Credential externalization
MITRE ATT&CK
2 techniques across 2 tactics: Persistence, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only obtaining the GV-Eye Android application package (publicly distributable) and reverse-engineering it to recover the statically embedded API key - no authentication, user interaction, or non-default configuration is needed, and the affected build is GV-Eye V3.6.0. The practical limiting factor is scope of impact rather than access difficulty: abuse is bounded entirely by whatever the single hardcoded key is permitted to do on the backend/third-party service, and the description does not specify those privileges, so the realistic blast radius cannot be determined from available data. |
| Impact | This is a CWE-798 hardcoded-credential exposure in the GeoVision GV-Eye Android app (V3.6.0), scored CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The CVSS network vector and C:H drive the 'High' rating, but the signals are thin: no EPSS probability, no CISA KEV listing, and no public POC are provided, so this is no public exploit identified at time of analysis. The AV:N label is somewhat generous - the key is extracted by reverse-engineering a locally-held APK rather than by a direct network request, though because Android packages are publicly distributable the practical reach is effectively anyone who downloads the app. The genuine risk hinges on a data point the description does NOT provide: what the embedded API key actually authorizes. If it unlocks a shared backend/cloud service, C:H is justified and this is a real priority for GV-Eye operators; if it is a low-privilege or rate-limited third-party key, the real-world impact is far smaller than 7.5 suggests. Net: a credible, low-complexity, unauthenticated issue but with unquantified impact and no evidence of active or automated exploitation - treat as moderate priority pending confirmation of the key's scope from the vendor. |
| Exploit ScenarioDerived | An attacker downloads the publicly available GV-Eye Android APK, decompiles it with standard reverse-engineering tools, and recovers the hardcoded API key embedded in the client. They then replay that key against the associated backend/third-party service to access or abuse whatever functionality the credential authorizes. No special access or user interaction is required, but no public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Hardcoded API key exposure in the GeoVision GV-Eye Android application (V3.6.0) allows unauthenticated remote attackers to extract the key from the publicly distributable APK via reverse engineering and use it to access backend or third-party services, resulting in high confidentiality impact. With a CVSS score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and CWE-798 classification, the vulnerability requires no user interaction or special privileges, though the actual blast radius is limited by the permissions associated with the single exposed key. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
RemediationAI
No vendor-released patch was identified at the time of analysis. The vendor advisory at https://www.geovision.com.tw/cyber_security.php should be monitored for updates; if a patched version is released, upgrade to that version. As immediate compensating controls, GeoVision and backend service operators should rotate the exposed hardcoded API key to invalidate any extracted copies, and restrict the key's permissions to the minimum necessary scope to limit abuse. Additionally, the API key should be removed from the client application entirely and replaced with a server-side token exchange or short-lived, scoped tokens; however, such architectural changes require backend and app refactoring. Until a fix is available, monitor API usage for anomalous activity originating from unauthorized clients, and consider blocking requests that use the known hardcoded key if feasible. Note that code obfuscation alone is not a sufficient mitigation, as determined attackers can still reverse engineer the package.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-798 refers to the use of hardcoded credentials, which in this case is an API key embedded directly in the GeoVision GV-Eye Android application package (APK). Because Android apps are distributed in a largely readable format (DEX bytecode and resources), attackers can decompile or use automated tools to search for strings and recover the key without any authentication. The CPE cpe:2.3:a:geovision_inc.:gv-eye:*:*:*:*:*:*:*:* identifies the affected product as GeoVision GV-Eye, an Android app used for remote viewing of GeoVision surveillance cameras. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N indicates the key can be obtained remotely without prerequisites, but the impact is confidentiality-only (no integrity or availability impact) and is scoped to the permissions granted to that key on the backend service. The root cause is the failure to store sensitive credentials server-side or use a secure token exchange mechanism.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Key is trivially extractable from the publicly distributed APK without auth (AC:L/PR:N); AV:N retained since packages are network-distributed, C:H assumed as the key grants data access, with I/A:N as no modification is implied.
Primary rating from Vendor (GV).
CVSS VectorVendor: GV
DescriptionCVE.org
API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.
Executive ViewAI
A hardcoded API key embedded in the GeoVision GV-Eye Android application (V3.6.0) can be recovered by anyone who downloads and reverse-engineers the publicly available APK, allowing unauthenticated attackers to reach the backend or third-party services that key unlocks. Because the app is freely distributed and the weakness requires no credentials or user action, any organization whose staff, integrators, or customers use GV-Eye to view or manage GeoVision camera estates should assume the key is already discoverable by outsiders. Leadership should care because the exposure is silent, persistent, and cannot be remediated by patching the app alone - the key must be rotated and the affected services reviewed for unauthorized access.
No vendor-released patch identified at time of analysis. Interim mitigations: rotate or revoke the exposed API key and any credentials it can reach; restrict the key's backend permissions to least privilege or disable it where rotation is not immediately feasible; monitor service and API logs for unauthorized use; remove or block the GeoVision GV-Eye V3.6.0 app from managed and BYOD devices until a fixed release is available; and require vendor confirmation of how secrets will be stored in future app versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB