Threat database

A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .

A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .

GV-E-Map Server version 18.2.0A contains a hard-coded plaintext database password embedded within an application component. This credential can be extracted through static analysis of the distributed binary and may also be exposed in process memory during runtime. The vulnerability is identified as CWE-798 (Use of Hard-coded Credentials) and has a CVSS 3.1 score of 6.2 (medium severity). There is no information about an available patch or official remediation from the vendor.

Transmission of a sensitive key in the URL over an unencrypted HTTP connection.  The request is sent over HTTP rather than HTTPS, meaning the key is transmitted in plaintext across the network. An attacker with the ability to monitor network traffic could intercept the request and obtain the key

CVE-2026-103097 is a high-severity vulnerability in GeoVision Inc.'s GV-Eye Android application version 3.6.0. The issue involves a hardcoded API key embedded within the application package, which can be extracted through reverse engineering. This exposure allows unauthorized users to misuse the API key, potentially leading to unauthorized access to services relying on this key. The vulnerability does not affect confidentiality of user data directly but compromises the security of the API key itself.

CVE-2026-103096 is a vulnerability in GeoVision Inc.'s GV-Eye Android application version 3.6.0 where an API key is hardcoded and can be extracted from the application package. Because Android apps can be reverse engineered, this allows unauthorized users to retrieve and misuse the embedded API key. The vulnerability has a high severity with a CVSS score of 7.5, indicating a network attack vector with no privileges or user interaction required and high confidentiality impact. No official patch or remediation guidance is currently provided by the vendor. Users should check for vendor advisories for updates and avoid distributing the vulnerable version until a fix is available.

CVE-2026-92838 is a DLL hijacking vulnerability in GeoVision Inc.'s GV-Remote E-map desktop application version 18.3.1. The application loads dynamic-link libraries from an unsafe search path, which allows a local attacker with write access to place a malicious DLL in a location searched before the legitimate one. Successful exploitation can lead to arbitrary code execution within the security context of the GV-Remote E-map process.

GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, allowing remote exhaustion of memory, connection, and worker resources.

GeoVision GV-LPC2211 V1.14 (260903) fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple VLSVR request handlers, allowing an unauthenticated remote attacker to crash the VLSVR service.

GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the root-run web service.

GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrupt stack control state and crash the discovery process.

GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ connections.

GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication, allowing remote clients to retrieve PTZ information and issue PTZ or raw serial commands.

GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker.

GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker.

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update.

GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF DeleteUsers requests, allowing an authenticated administrator to overflow a stack array and crash the ONVIF worker.

GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allowing an authenticated administrator to crash the ONVIF worker.

GeoVision GV-LPC2211 V1.13 copies oversized ONVIF CreateUsers username or password values into fixed stack fields, allowing an authenticated administrator to crash the ONVIF worker.

GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection, allowing a captured PasswordDigest token to be replayed for subsequent ONVIF operations.