CVE-2026-103098

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-103098", "assignerOrgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "state": "PUBLISHED", "assignerShortName": "GV", "dateReserved": "2026-09-30T02:10:02.128Z", "datePublished": "2026-10-02T00:15:17.848Z", "dateUpdated": "2026-10-02T18:19:15.437Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "shortName": "GV", "dateUpdated": "2026-10-02T00:15:17.848Z"}, "title": "GV-Eye Sensitive information exposure in URL query parameter Vulnerability", "datePublic": "2026-09-30T02:15:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-319", "description": "CWE-319 Cleartext transmission of sensitive information", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-158", "descriptions": [{"lang": "en", "value": "CAPEC-158 Sniffing Network Traffic"}]}], "affected": [{"vendor": "GeoVision Inc.", "product": "GV-Eye", "platforms": ["Android"], "packageName": "tw.com.geovision.gveye", "versions": [{"status": "affected", "version": "V3.6.0"}, {"status": "unaffected", "version": "V3.7.2"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:geovision_inc.:gv-eye:v3.6.0:*:android:*:*:*:*:*"}, {"vulnerable": false, "criteria": "cpe:2.3:a:geovision_inc.:gv-eye:v3.7.2:*:android:*:*:*:*:*"}]}]}], "descriptions": [{"lang": "en", "value": "Transmission of a sensitive key in the URL\nover an unencrypted HTTP connection.\u00a0 The\nrequest is sent over HTTP rather than HTTPS, meaning the key is transmitted in\nplaintext across the network. An attacker with the ability to monitor network\ntraffic could intercept the request and obtain the key", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Transmission of a sensitive key in the URL\nover an unencrypted HTTP connection.  The\nrequest is sent over HTTP rather than HTTPS, meaning the key is transmitted in\nplaintext across the network. An attacker with the ability to monitor network\ntraffic could intercept the request and obtain the key"}]}], "references": [{"url": "https://www.geovision.com.tw/cyber_security.php", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "credits": [{"lang": "en", "value": "Lloyd Lexter Gealon", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-02T18:19:07.251183Z", "id": "CVE-2026-103098", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-02T18:19:15.437Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-103098", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-02T18:19:07.251183Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-02T18:19:11.839Z"}}], "cna": {"title": "GV-Eye Sensitive information exposure in URL query parameter Vulnerability", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Lloyd Lexter Gealon"}], "impacts": [{"capecId": "CAPEC-158", "descriptions": [{"lang": "en", "value": "CAPEC-158 Sniffing Network Traffic"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "GeoVision Inc.", "product": "GV-Eye", "versions": [{"status": "affected", "version": "V3.6.0"}, {"status": "unaffected", "version": "V3.7.2"}], "platforms": ["Android"], "packageName": "tw.com.geovision.gveye", "defaultStatus": "unaffected"}], "datePublic": "2026-09-30T02:15:00.000Z", "references": [{"url": "https://www.geovision.com.tw/cyber_security.php", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "Transmission of a sensitive key in the URL\nover an unencrypted HTTP connection.\u00a0 The\nrequest is sent over HTTP rather than HTTPS, meaning the key is transmitted in\nplaintext across the network. An attacker with the ability to monitor network\ntraffic could intercept the request and obtain the key", "supportingMedia": [{"type": "text/html", "value": "Transmission of a sensitive key in the URL\nover an unencrypted HTTP connection.  The\nrequest is sent over HTTP rather than HTTPS, meaning the key is transmitted in\nplaintext across the network. An attacker with the ability to monitor network\ntraffic could intercept the request and obtain the key", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-319", "description": "CWE-319 Cleartext transmission of sensitive information"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:geovision_inc.:gv-eye:v3.6.0:*:android:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:geovision_inc.:gv-eye:v3.7.2:*:android:*:*:*:*:*", "vulnerable": false}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "shortName": "GV", "dateUpdated": "2026-10-02T00:15:17.848Z"}}}, "cveMetadata": {"cveId": "CVE-2026-103098", "state": "PUBLISHED", "dateUpdated": "2026-10-02T18:19:15.437Z", "dateReserved": "2026-09-30T02:10:02.128Z", "assignerOrgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "datePublished": "2026-10-02T00:15:17.848Z", "assignerShortName": "GV"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "tw.com.geovision.gveye", "platforms": ["Android"], "product": "GV-Eye", "vendor": "GeoVision Inc.", "versions": [{"status": "affected", "version": "V3.6.0"}, {"status": "unaffected", "version": "V3.7.2"}]}], "source": "0df08a0e-a200-4957-9bb0-084f562506f9"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Transmission of a sensitive key in the URL\nover an unencrypted HTTP connection.\u00a0 The\nrequest is sent over HTTP rather than HTTPS, meaning the key is transmitted in\nplaintext across the network. An attacker with the ability to monitor network\ntraffic could intercept the request and obtain the key"}], "id": "CVE-2026-103098", "lastModified": "2026-10-02T19:16:39.350", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "0df08a0e-a200-4957-9bb0-084f562506f9", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-103098", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-02T18:19:07.251183Z", "version": "2.0.3"}}]}, "published": "2026-10-02T01:16:43.193", "references": [{"source": "0df08a0e-a200-4957-9bb0-084f562506f9", "url": "https://www.geovision.com.tw/cyber_security.php"}], "sourceIdentifier": "0df08a0e-a200-4957-9bb0-084f562506f9", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-319"}], "source": "0df08a0e-a200-4957-9bb0-084f562506f9", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["Android"], "status": "affected", "versions": {"scheme": "generic", "value": "V3.6.0"}}, {"platform": ["Android"], "status": "unaffected", "versions": {"scheme": "generic", "value": "V3.7.2"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}]}, "product": "gv-eye", "vendor": "geovision"}], "created": "2026-10-02T02:30:18.249924+00:00", "updated": "2026-10-02T14:47:00.295897+00:00", "vendors": ["geovision", "geovision$PRODUCT$gv-eye"]}