GV-IP Device Utility CVE-2026-42363

Attacker must have network access to the same broadcast domain (LAN segment) as the GeoVision GV-IP Device Utility and managed devices - typically achievable via rogue device connection, compromised workstation, or insider position. Exploitation requires an authenticated administrator to actively use the utility to send privileged commands during the monitoring window (UI:R constraint), making this a passive eavesdropping attack dependent on operational timing. The broadcast UDP protocol is only used for specific management functions; exploitation window exists during device configuration, troubleshooting, or bulk provisioning activities. Network switches supporting promiscuous mode or broadcast forwarding enable packet capture. Exploitation limits: Requires reverse-engineering the proprietary Blowfish-variant algorithm (one-time effort, reusable across all vulnerable deployments); attacker needs packet capture tools and protocol analysis capability; physical or logical network access required (not remotely exploitable over internet).

Real-world risk is CRITICAL for GeoVision surveillance deployments despite requiring user interaction (UI:R). The CVSS vector indicates network attack (AV:N) with low complexity (AC:L) and no authentication (PR:N), while scope change (S:C) accurately reflects the attack path: compromise the management utility to gain control over physical security devices. The UI:R constraint means an administrator must actively manage a device, but in operational surveillance environments this occurs routinely during configuration, troubleshooting, or firmware updates. The confidentiality/availability impacts (C:H/A:H) enable credential theft AND device disruption through factory resets. EPSS data and KEV status are not provided, but the broadcast-based passive attack requires only network access and protocol knowledge - highly automatable once the Blowfish variant is reverse-engineered. The Talos Intelligence advisory reference suggests active researcher analysis. Primary risk: physical security bypass through camera reconfiguration or disablement. Organizations using GeoVision IP devices for critical infrastructure surveillance face operational technology (OT) security risk, as attackers gaining device control can create blind spots, redirect feeds, or disable recording during intrusions.

An attacker connects a laptop to the corporate network where GeoVision IP cameras are deployed, running Wireshark in promiscuous mode to capture UDP broadcasts. When the security administrator uses GV-IP Device Utility 9.0.5 to change a camera's IP address, the utility broadcasts the privileged command with admin credentials encrypted using the Blowfish-variant algorithm. The attacker extracts the symmetric key and ciphertext from the same captured packet, decrypts the credentials using a reverse-engineered implementation of GeoVision's algorithm, and gains full administrative access to the camera. They reconfigure the device to stream footage to an external server or factory-reset it to disable surveillance during a physical intrusion.