Insufficient Encryption Vulnerability in GeoVision GV-IP Device Utility
CVE-2026-7161

9.3CRITICAL

Key Information:

Vendor

Geovision Inc.

Status
Gv-ip Device Utility
Vendor
CVE Published:
4 May 2026

What is CVE-2026-7161?

An insufficient encryption vulnerability exists in the Device Authentication functionality of GeoVision's GV-IP Device Utility, specifically version 9.0.5. This vulnerability arises when privileged commands are sent over the network, requiring the device's username and password. In this instance, the credentials are transmitted in a manner that exposes them to interception through broadcast packets. The encryption method used, derived from Blowfish, includes the symmetric key within the same broadcast packet, allowing attackers on the same LAN to decipher the credentials easily. Once compromised, an attacker can take full control of the device, altering configurations or resetting it to factory defaults.

Affected Version(s)

GV-IP Device Utility Windows 9.0.5.0

GV-IP Device Utility Windows 9.0.7.0

References

https://www.geovision.com.tw/cyber_security.php
vendor-advisory
https://talosintelligence.com/vulnerability_reports/
third-party-advisory

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Philippe Laulheret of Cisco Talos.
Kelly Patterson of Cisco Talos.
Martin Zeiser of Cisco Talos.
.