GV-Eye EUVD-2026-91147

Exploitation requires the attacker to possess the GV-Eye V3.6.0 Android application package (APK) - trivially satisfied since the app is publicly distributed - and the ability to reverse engineer it to recover the embedded API key; no authentication, user interaction, or special target configuration is needed because the credential ships in the default client build. The practical LIMIT is that impact is scoped to whatever the single hardcoded key authorizes on GeoVision's server-side API, and effective abuse depends on that backend remaining reachable and not having revoked or rotated the key; the flaw affects the specific GV-Eye V3.6.0 release.

This is CWE-798 (hardcoded credentials): an API key embedded in the GeoVision GV-Eye Android application package and recoverable via reverse engineering. The input CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) scores confidentiality-only impact at network reach, but this is internally inconsistent with the actual mechanism: key EXTRACTION requires possessing and decompiling the APK, which is a local/offline action (AV:L), even though subsequent MISUSE of the recovered key against the backend is network-borne - the NVD vector appears to score the misuse rather than the flaw itself, so AV:N likely overstates the exploitation path. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active or automated exploitation. Net real-world risk is moderate, not critical: the defect is trivial to exploit once the APK is obtained (any installer has the package), but overall impact is bounded by what the single hardcoded key actually authorizes on GeoVision's API, which the advisory data does not specify. Treat as a genuine credential-exposure issue warranting the vendor's key rotation/server-side fix rather than an urgent widespread-attack scenario.

An attacker downloads the publicly distributed GV-Eye V3.6.0 Android APK, decompiles it with standard reverse-engineering tools (e.g., jadx/apktool), and extracts the hardcoded API key from the package resources or code. The attacker then replays that key against GeoVision's backend API to access or abuse whatever functionality the key authorizes, impersonating the legitimate application. No POC was provided, and extraction is low-complexity but requires local access to the app package before any network misuse.