Read the docs
TI-2026-70816 Aliases CVE-2026-107437GHSA-rfwp-c2wc-rqp4

Plaintext database password exposure in GV-E-map Server

Priority LOW 26CWE-798Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-798.

Summary

GeoVision GV-E-map Server from 18.2.0A before 18.4 embeds a database password in plaintext within an application component (CWE-798). A local attacker without privileges can recover the credential by static analysis of the distributed binary or from process memory at runtime.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

GV-E-Map Server V18.2.0A contains a plaintext database password embedded within an application component. The credential can be recovered through static analysis of the distributed binary and may also be exposed in process memory during runtime.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00114 1st percentileScored 2026-11-07
Fix Fixed GV-E-map Server (GeoVision Inc.): 18.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GeoVisionGV-E-map Server18.2.0A18.4Patch availableCNA
  • GV-E-map Server VendorGeoVision Affected 18.2.0A Fixed in 18.4 Patch available CNA

Remediation

GeoVision lists version 18.4 of GV-E-map Server as the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA GV-E-map Server (GeoVision Inc.) Fixed in 18.4

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-107437
  2. 2026-10-12 Alias added: GHSA-rfwp-c2wc-rqp4
  3. 2026-10-12 Priority changed: MEDIUM → LOW
  4. 2026-10-16 CISA SSVC decision points changed

References

Advisory 1

  • TI-2024-10304 GeoVision EOL devices - OS Command Injection KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-05603 GeoVision EOL device - OS Command Injection KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-15344 GeoVision Command Injection RCE via /PictureCatch.cgi CVSS 4.0CRITICAL 10.0
  • TI-2021-22411 GeoVision Geowebserver 5.3.3 - Local FIle Inclusion CVSS 4.0HIGH 8.7
  • TI-2026-41681 GV-LPC2011/LPC2211 - unauthorized buffer overflow via RTSP Digest username (ssvr) CVSS 3.1CRITICAL 9.8
  • TI-2026-41680 GV-LPC2011/LPC2211 - unauthorized buffer overflow via AuthMode/AuthValue path (ssvr) CVSS 3.1CRITICAL 9.8
See all 105 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences