PT-2026-36739 · Geovision · Gv-Ip Device Utility

Kelly Patterson + 2 · Published 2026-05-04 · Updated 2026-05-04 · CVE-2026-7161

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions GeoVision GV-IP Device Utility version 9.0.5

Description Insufficient encryption in the Device Authentication functionality allows for the leak of credentials. When the utility sends privileged commands to devices over UDP, the username and password are encrypted using a symmetric key that is also included within the same packet. An attacker on the same local area network can listen to these broadcast messages and decrypt the credentials, potentially gaining full control over the device configuration to change the IP address or reset the device to factory defaults.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-656

Related Identifiers

CVE-2026-7161

Affected Products

Gv-Ip Device Utility

References · 5

• https://geovision.com.tw/cyber_security.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7161 · Security Note
• https://twitter.com/VulmonFeeds/status/2051127155606577416 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1t3imrn/critical_geovision_gvip_utility_vulnerability · Reddit Post
• https://talosintelligence.com/vulnerability_reports · Note