The GV‑E‑Map Server version 18.2.0A includes a hard‑coded database password inside a compiled binary. Static analysis of the deployed executable can recover the credential, and the password may also be read from process memory during normal operation. The exposed credential could allow an attacker to authenticate with the database server, potentially gaining unauthorized access to data or control over database operations. This flaw is a classic example of CWE‑798, where insecure storage of a credential in plaintext leads to privilege escalation and data compromise.

Affected systems are deployed by GeoVision Inc. and consist of the GV‑E‑Map Server product. The vulnerability is present in version 18.2.0A and is also listed for the 18.4 family of releases according to the provided CPE strings. No other versions are explicitly mentioned as affected.

The CVSS score is 6.2, indicating a moderate severity level. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, as the credential can be extracted from the binary or process memory on a system where the application is installed. Remote exploitation would require an attacker to obtain the binary or memory dump, which is less straightforward and therefore less probable. The moderate CVSS score reflects the fact that, while the password exposure is serious, it generally requires local access or the ability to analyze the deployed executable.