GeoVision GV-IP Device Utility 9.0.5.0 uses an encryption scheme derived from Blowfish to protect device credentials, but the symmetric key is transmitted alongside the encrypted username and password in broadcast UDP packets. An attacker on the same LAN can capture these packets, decrypt the credentials using a known implementation of the algorithm, and obtain full administrative control over the device. With such credentials an attacker can alter the device’s network configuration, reset it to factory defaults, or otherwise execute arbitrary privileged commands, effectively compromising the device’s integrity and availability.

The vulnerability affects GeoVision Inc.'s GV-IP Device Utility, specifically version 9.0.5.0 and earlier releases that employ the described broadcast authentication process. The vendor has released 9.0.7.0 as a patch to address this issue.

The CVSS score of 9.3 reflects a severe impact, while the EPSS score of < 1% indicates that exploit attempts are currently rare. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be a local LAN attacker able to observe broadcast traffic; thus an attacker who can join the same network segment or sniff broadcast packets could leverage this flaw with minimal prerequisites.