CVE-2026-42363: GeoVision GV-IP Device Utility Critical Credential Leak

The National Vulnerability Database reports a critical insufficient encryption vulnerability, CVE-2026-42363, in GeoVision GV-IP Device Utility 9.0.5. This flaw allows attackers on the same local area network (LAN) to intercept broadcast packets and decrypt device credentials. The utility, when interacting with GeoVision devices, transmits privileged commands that include usernames and passwords. While these are encrypted, the symmetric key for the Blowfish-derived scheme is also sent within the same packet. This effectively nullifies any cryptographic protection, reducing security to mere obscurity.

An attacker simply needs to listen to broadcast traffic when an administrator interacts with a GeoVision device. With the intercepted key and encrypted credentials, they can implement the algorithm to fully decrypt the username and password. This grants complete control over the device’s configuration, enabling changes to its IP address or even a factory reset. The National Vulnerability Database assigns this a CVSS score of 9.3 (CRITICAL), underscoring the severe impact of this credential exposure.

The core issue here is a fundamental cryptographic failure: sending the key alongside the encrypted data. This isn’t a complex exploit; it’s a glaring design flaw. Defenders need to understand that anything relying on ‘security through obscurity’ is inherently broken. This vulnerability presents a straightforward path to full device compromise for any attacker with LAN access, turning what should be secure device management into an open book.