CVE-2026-107437
6.2MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-798
Impact
Local attackers can recover plaintext database credentials directly from application binaries or process memory. This allows unauthorized access to the underlying database without needing an existing account.
Root cause
The application hardcodes a plaintext database password directly inside a compiled binary component.
Affected systems
GV-E-Map Server V18.2.0A
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
Check the vendor advisory for a patched release; as an interim mitigation, restrict local filesystem and process inspection permissions on the server, and firewall the database to only accept connections from trusted application IPs.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
GV-E-Map Server V18.2.0A contains a plaintext database password embedded within an application component. The credential can be recovered through static analysis of the distributed binary and may also be exposed in process memory during runtime.