Loading vulnerability…
Insufficient Encryption Credential Exposure in GeoVision GV-IP Device Utility 9.0.5 Device Authentication
CVE-2026-42363 is an insufficient encryption vulnerability in the Device Authentication functionality of GeoVision GV-IP Device Utility 9.0.5. When the utility interacts with GeoVision devices on the local network and sends privileged commands, it may transmit authentication material in UDP broadcast traffic using a proprietary symmetric encryption scheme derived from Blowfish. The implementation is fundamentally flawed because the symmetric key needed to decrypt the protected username and password is included in the same packet. As a result, the confidentiality of the credentials depends only on obscurity rather than effective cryptographic protection. An attacker on the same local network can passively capture the broadcast traffic generated when an administrator interacts with a device and recover the device credentials, which can then be used to authenticate to the affected device and issue privileged administrative actions.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation exposes valid device credentials for affected GeoVision devices. With recovered administrative credentials, an attacker can gain unauthorized authenticated access to device management functions, take full control of device configuration, change network settings such as the device IP address, and reset the device to factory defaults. Depending on the role of the device in the environment, this can enable surveillance disruption, operational interference, and follow-on compromise of adjacent systems reachable from the device management plane.
If you can’t patch tonight, do this now.
Until a fixed version is deployed, restrict use of the utility to trusted, isolated management networks and minimize exposure of broadcast traffic to untrusted hosts on the same LAN. Limit administrative use of the utility, segment camera and device-management networks from general user networks, and monitor for unauthorized configuration changes on managed devices. Where possible, rotate device credentials after any suspected exposure and avoid performing sensitive administrative actions from shared or untrusted network segments.
Patch, then assume compromise.
Upgrade GeoVision GV-IP Device Utility to a vendor-fixed version that corrects the Device Authentication cryptographic design and prevents disclosure of credentials in broadcast traffic. Replace any credentials that may have been exposed, especially administrative passwords used by managed devices. Review device configurations for unauthorized changes and re-establish trusted settings where necessary.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.