GV-IP Device Utility CVE-2026-16519

Exploitation requires local access to the Windows host running GV-IP Device Utility and the ability to write a malicious DLL into a directory that Windows searches before the legitimate DLL location - in practice the application's working/launch directory or another attacker-writable path on the DLL search order. The attacker needs low-level privileges (PR:L) to place the file, and critically the payload only fires when a user actually launches the utility (UI:R), so exploitation is gated on that user action. Limiting factors: it is not remotely exploitable (AV:L), it does not work against a machine where standard users cannot write to any searched directory and the tool is run only from a protected install path, and it grants only the privileges of the account that runs the utility rather than automatic SYSTEM-level escalation.

This is a locally exploitable issue, not a remote one: the CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H yields 7.3 with attack vector Local, low complexity, low privileges required, and mandatory user interaction. The high confidentiality/integrity/availability impacts reflect that hijacked code runs with the privileges of whoever launches the utility, but the local vector plus required user interaction meaningfully caps real-world exploitability compared to a network-facing flaw. No EPSS score, no SSVC decision data, and no POC were provided; it is not in CISA KEV, so there is no public exploit identified at time of analysis. Realistically this is a moderate, post-compromise/local-escalation and persistence primitive rather than an urgent internet-facing emergency - prioritize it where GeoVision management workstations exist, but below any remotely exploitable finding. Note the tag 'Information Disclosure' is narrower than the vector's full C/I/A:H impact; treat the CVSS impact as authoritative and the tag as a partial label.

An attacker with an existing low-privileged foothold on a workstation (for example via phishing or a shared machine) drops a malicious DLL matching a library name the utility loads into a directory searched ahead of the legitimate one, such as the folder the operator runs the tool from. When an administrator or operator later launches GV-IP Device Utility to manage cameras, the planted DLL loads and executes attacker code in that user's context. No public POC is currently identified, and the attack requires the victim to run the application (UI:R).