The vulnerability arises when GV‑Eye transmits a sensitive key through a URL query parameter over an unencrypted HTTP connection. Because the request travels in plain text across the network, any entity capable of monitoring traffic can intercept the key. This constitutes an information disclosure flaw consistent with CWE‑319, allowing attackers to compromise the confidentiality of the key and potentially subvert device authentication or control.

The flaw affects GeoVision Inc’s GV‑Eye Android application. Known vulnerable releases are version 3.6.0 and 3.7.2, as identified by the vendor’s CNAs and the CPE listings.

The CVSS score of 7.5 indicates high-severity risk. The EPSS score is not available, though the absence of encryption means the vulnerability is readily exploitable by anyone with network visibility. The issue is not listed in CISA’s KEV catalog, but it remains a critical data exposure vector. An attacker could intercept the key by passively sniffing traffic or by being positioned on the same internal network, then use it to authenticate or control the device.