CVE-2026-7161

9.3 CRITICAL

An insufficient encryption vulnerability exists in the Device Authentication functionality of GeoVision GV-IP Device Utility 9.0.5

Published: 2026-05-04 · Last updated: 2026-06-15

Severity and scoring

CVSS: 9.3 CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H
CWE: CWE-656

Affected products

Vendor	Product
geovision	gv-ip_device_utility

Description

An insufficient encryption vulnerability exists in the Device Authentication functionality of GeoVision GV-IP Device Utility 9.0.5. Listening to broadcast packets can lead to credentials leak. An attacker can listen to broadcast messages to trigger this vulnerability. When interacting with various Geovision devices on the network, the utility may send privileged commands; in order to do so, the username and password of the device need to be provided. In some instances the command is broadcasted over UDP and the username/password are encrypted using a cryptographic protocol that appears to be derivated from Blowfish. However the symmetric key used for the encryption is also included in the packet, and thus the security of the username/password only relies on the "obscurity" of the encryption scheme. An attacker on the same LAN can listen to the broadcast traffic once an admin user interacts with the device, and decrypt the credentials using their own implementation of the algorithm. With this password the attacker would have full control over the device configuration, allowing them to change its ip address or even reset it to factory default.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-7161
[Other]https://talosintelligence.com/vulnerability_reports/
[Vendor advisory]https://www.geovision.com.tw/cyber_security.php
[Other]https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2322

Related CVEs

Same vendor

CVE-2026-42370 — A stack overflow vulnerability exists in the WebCam Server Login functionality of GeoVision GV-VMS V20 20.0.2 (9.0 CRITICAL)
CVE-2026-42368 — A privilege escalation vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10 (9.9 CRITICAL)
CVE-2026-42367 — A privilege escalation vulnerability exists in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 1.10 (6.5 MEDIUM)
CVE-2026-42365 — A guessable session cookie vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10 (8.6 HIGH)
CVE-2026-42364 — An os command injection vulnerability exists in the DdnsSetting.cgi functionality of GeoVision LPC2011/LPC2211 1.10 (9.9 CRITICAL)

Same CWE

CVE-2026-42363 — An insufficient encryption vulnerability exists in the Device Authentication functionality of GeoVision GV-IP Device Utility 9.0.5 (9.3 CRITICAL)