EUVD-2026-48512
GHSA-j3wr-f3m6-3p54
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Local DLL planting needs a low-priv foothold (PR:L) and only fires when the operator runs the tool (UI:R); hijacked code inherits full user context, so C/I/A:H.
Primary rating from Vendor (GV).
CVSS VectorVendor: GV
Lifecycle Timeline
2DescriptionCVE.org
A DLL hijacking vulnerability exists in the GeoVision GV-IP Device Utility desktop application. The application loads one or more dynamic-link libraries (DLLs) from an unsafe search path, allowing a local attacker to place a malicious DLL in a location searched before the legitimate library location.
AnalysisAI
Local privilege/code execution in GeoVision's GV-IP Device Utility is possible via DLL hijacking (CWE-427): the Windows desktop application loads one or more DLLs from an unsafe search path, letting a local attacker who can plant a malicious DLL run code in the context of the user who launches the utility. Exploitation requires the victim to execute the application (UI:R) and the attacker to already have a foothold with low privileges on the host (PR:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; CVSS is 7.3 (High).
Technical ContextAI
GV-IP Device Utility is a Windows helper tool distributed by GeoVision (a Taiwanese IP video-surveillance vendor) used to discover, configure, and update GeoVision GV-IP cameras and encoders on a network. The root cause is CWE-427, Uncontrolled Search Path Element: when a Windows process calls LoadLibrary without a fully qualified path, the OS walks a default search order that historically includes the application's current working directory and other attacker-writable locations before trusted system directories. If a required DLL is absent from a trusted directory, or the working directory is checked first, a same-named malicious DLL placed earlier in that order is loaded and its DllMain runs inside the application process. The single affected CPE is cpe:2.3:a:geovision_inc.:gv-ip_device_utility:*:*:*:*:*:*:*:*, with no version boundary published, so all shipped versions should be treated as potentially affected until the vendor states otherwise.
RemediationAI
Consult and apply the fix referenced on GeoVision's security advisory page at https://www.geovision.com.tw/cyber_security.php and upgrade to the vendor's patched build once identified - an exact fixed version is not stated in the available data, so no version number is asserted here. Until a patched build is confirmed installed, reduce the DLL-hijacking surface with concrete controls: run GV-IP Device Utility only from a fully trusted install directory (e.g. under Program Files) and never launch it from Downloads, a USB drive, network share, or any world-writable folder, since Windows searches the working directory early; remove write permissions for standard users on the application's install directory and on any directory the utility is launched from; and restrict who can log in locally to the workstations that host this tool. Each of these limits an attacker's ability to pre-position a malicious DLL but does not remove the flawed search behavior - only the vendor update does that. Consider uninstalling the utility from workstations where it is not actively needed for camera management.
More in Gv Ip Device Utility
View allCredential interception in GeoVision GV-IP Device Utility 9.0.5 allows network attackers to decrypt administrator passwo
Credential disclosure in GeoVision GV-IP Device Utility 9.0.5 allows network attackers to intercept administrator passwo
Same weakness CWE-427 – Uncontrolled Search Path Element
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today