GV-IP Device Utility CVE-2026-7161

Attacker must have network access to the same broadcast domain (LAN segment) as the GV-IP Device Utility management workstation and target GeoVision devices - this is NOT internet-exploitable despite CVSS AV:N classification. Exploitation requires a legitimate administrator to actively use the utility to send privileged commands (UI:R - user interaction required), providing the timing window for packet capture. No authentication is required for the attacker to intercept broadcasts (PR:N). The vulnerability is exploitable against default configurations of GV-IP Device Utility 9.0.5 when used on standard switched Ethernet or WiFi networks. Exploitation is LIMITED by: network topology (attacker must be on same VLAN/subnet as management traffic), administrator activity timing (passive wait for broadcasts), and need for reverse-engineered decryption implementation (though Talos Intelligence publication lowers this barrier). NOT exploitable from internet, across routed networks, or if devices are managed via isolated out-of-band network.

Real-world risk is HIGH for organizations using GeoVision IP camera infrastructure, particularly in shared network environments. CVSS 9.3 accurately reflects severity: successful exploitation yields High confidentiality impact (admin credentials exposed) and High availability impact (attacker can factory-reset devices). However, CVSS does not capture temporal factors - UI:R (user interaction required) means exploitation depends on administrator activity timing, making this opportunistic rather than on-demand. Attack complexity is genuinely Low (AC:L) because packet capture and Blowfish reversal are well within script-kiddie capabilities once the algorithm is documented (Talos Intelligence has published analysis). The Changed scope (S:C) correctly models cross-component impact: compromising the utility's broadcast yields access to separate physical devices. No EPSS or KEV data available suggests either recent disclosure or limited attacker interest in niche surveillance infrastructure - but absence of exploitation data is NOT evidence of safety. CRITICAL LIMITATION: AV:N (network vector) in CVSS conflicts with the description's LAN requirement - this is NOT internet-exploitable, so the 'Network' classification overstates reach. Real attack vector is Adjacent Network (AV:A), which would lower base score to 8.3. Defenders should treat this as HIGH priority for camera networks accessible to semi-trusted users (guest WiFi, shared office LANs, multi-tenant buildings) but MEDIUM for isolated surveillance VLANs.

An attacker connects a laptop to the corporate network (via guest WiFi or compromised Ethernet jack) and runs packet capture targeting UDP broadcast traffic. When a security administrator uses GV-IP Device Utility to reconfigure a lobby camera's IP address, the utility broadcasts the privileged command with encrypted admin credentials. The attacker's script identifies the GeoVision protocol signature, extracts the embedded symmetric key from the packet, applies the reverse-engineered Blowfish variant (publicly documented by Talos Intelligence), and decrypts the plaintext username and password. Using these credentials, the attacker logs into all GeoVision devices on the network, changes camera orientations to create blind spots, or factory-resets devices to cause availability disruption during a physical intrusion.