Loading vulnerability…
Insufficient encryption in GeoVision GV-IP Device Utility 9.0.5 Device Authentication
CVE-2026-7161 is an insufficient encryption vulnerability in the Device Authentication functionality of GeoVision GV-IP Device Utility 9.0.5. When the utility interacts with GeoVision devices on the network, it may send privileged commands over broadcast UDP and include device credentials encrypted with a proprietary scheme reportedly derived from Blowfish. The flaw is that the symmetric key used to protect the username and password is also included in the same packet, rendering the encryption ineffective and reducing protection to obscurity. An attacker on the same local network can passively capture the broadcast traffic generated during administrator interaction with a device and recover the credentials by implementing the observed algorithm.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation exposes device authentication credentials to an attacker on the same LAN. With the recovered credentials, the attacker can authenticate to the affected device and obtain full control over device configuration. Documented consequences include changing the device IP address and resetting the device to factory defaults. The vulnerability therefore enables severe confidentiality loss for credentials and can also cause significant operational disruption through unauthorized reconfiguration or reset.
If you can’t patch tonight, do this now.
Restrict access to the local network segments where the utility and managed devices operate, and prevent untrusted users or systems from joining or monitoring those segments. Minimize or suspend use of the vulnerable Device Authentication workflow until patched. Apply network segmentation and administrative isolation so that only trusted management hosts can observe device-management traffic. Monitor for unauthorized device reconfiguration and unexpected resets as potential signs of credential compromise.
Patch, then assume compromise.
Upgrade GeoVision GV-IP Device Utility 9.0.5 to a vendor-fixed release that removes credential exposure in broadcast traffic and implements proper cryptographic protection for authentication data. If a fixed version is not yet deployed, discontinue use of the vulnerable utility where possible or replace the affected workflow with a management method that does not broadcast recoverable credentials on the local network.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.