---
cve: "CVE-2026-103097"
severity: "HIGH"
cvss: 7.5
epss: "0.2%"
vendor: "GeoVision Inc."
kev: false
exploited: false
published: "2026-10-02 01:16:43"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-10-03T07:09:46+02:00"
---

# CVE-2026-103097

> 7.5 HIGH

## Beschreibung

An API key is
hardcoded and retrievable from the application package. Since Android
applications can be reverse engineered, embedding sensitive API credentials
directly in the client application may allow unauthorized users to extract and
misuse the key.

## CNA-Record (Kanon, cvelistV5)

- CNA: **GV**
- State: PUBLISHED
- Stand: 2026-10-02 19:51:12
- CNA-CVSS: **7.5** (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Keine | good |
| A Verfügbarkeit | Keine | good |

## Referenzen

- <https://www.geovision.com.tw/cyber_security.php>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-103097) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_