CVE-2026-107437: Plaintext Database Password Exposure in GV-E-Map Server V18.2.0A
GV-E-Map Server V18.2.0A contains a plaintext database password embedded within an application component. The credential can be recovered through static analysis of the distributed binary and may also be exposed in process memory during runtime.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of GeoVision GV-E-Map Server V18.2.0A are affected if an attacker can obtain and statically analyze the distributed application binary, or inspect the server process memory at runtime.
What does an attacker need to exploit the exposure?
The attack vector is local and requires no privileges or user interaction. An attacker needs access sufficient to analyze the binary or access the process memory containing the embedded database credential.
What is the potential impact of recovering the credential?
The disclosed impact is high confidentiality impact. The recovered plaintext database password could expose data accessible through the associated database account.