Insufficient Encryption Vulnerability in GeoVision GV-IP Device Utility
CVE-2026-42363

9.3CRITICAL

Key Information:

Vendor

Geovision Inc.

Status
Gv-ip Device Utility
Vendor
CVE Published:
26 April 2026

What is CVE-2026-42363?

An insufficient encryption vulnerability in GeoVision's GV-IP Device Utility allows attackers to listen for broadcast packets that transmit sensitive credentials. When interacting with various GeoVision devices, the utility transmits commands containing the device's username and password, which are meant to be encrypted. However, the symmetric key used for encryption is transmitted in the packet itself, exposing the encryption method to determined attackers on the same local area network. By intercepting this broadcast traffic, attackers can easily retrieve and decrypt the credentials, gaining unauthorized access to modify the device configuration, potentially altering IP settings or resetting devices to factory defaults.

Affected Version(s)

GV-IP Device Utility Windows 9.0.5.0

References

https://www.geovision.com.tw/cyber_security.php
vendor-advisory
https://talosintelligence.com/vulnerability_reports/
third-party-advisory

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Philippe Laulheret of Cisco Talos.
Kelly Patterson of Cisco Talos.
.