CVE-2026-42363

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42363", "assignerOrgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "state": "PUBLISHED", "assignerShortName": "GV", "dateReserved": "2026-04-26T23:39:08.350Z", "datePublished": "2026-04-26T23:58:49.334Z", "dateUpdated": "2026-04-27T13:30:33.786Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "shortName": "GV", "dateUpdated": "2026-04-26T23:58:49.334Z"}, "title": "GeoVision GV-IP Device Utility Device Authentication insufficient encryption vulnerability", "datePublic": "2026-04-27T00:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-656", "description": "CWE-656 - Reliance on Security Through Obscurity", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-158", "descriptions": [{"lang": "en", "value": "CAPEC-158 Sniffing Network Traffic"}]}, {"capecId": "CAPEC-37", "descriptions": [{"lang": "en", "value": "CAPEC-37 Retrieve Embedded Sensitive Data"}]}], "affected": [{"vendor": "GeoVision Inc.", "product": "GV-IP Device Utility", "platforms": ["Windows"], "versions": [{"status": "affected", "version": "9.0.5.0"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:geovision_inc.:gv-ip_device_utility:9.0.5.0:*:windows:*:*:*:*:*"}]}]}], "descriptions": [{"lang": "en", "value": "An insufficient encryption vulnerability exists in the Device Authentication functionality of GeoVision GV-IP Device Utility 9.0.5. Listening to broadcast packets can lead to credentials leak. An attacker can listen to broadcast messages to trigger this vulnerability.\n\n\nWhen interacting with various Geovision devices on the network, the utility may send privileged commands; in order to do so, the username and password of the device need to be provided. In some instances the command is broadcasted over UDP and the username/password are encrypted using a cryptographic protocol that appears to be derivated from Blowfish. However the symmetric key used for the encryption is also included in the packet, and thus the security of the username/password only relies on the \"obscurity\" of the encryption scheme. An attacker on the same LAN can listen to the broadcast traffic once an admin user interacts with the device, and decrypt the credentials using their own implementation of the algorithm. With this password the attacker would have full control over the device configuration, allowing them to change its ip address or even reset it to factory default.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An insufficient encryption vulnerability exists in the Device Authentication functionality of GeoVision GV-IP Device Utility 9.0.5. Listening to broadcast packets can lead to credentials leak. An attacker can listen to broadcast messages to trigger this vulnerability.<div><br></div><div>When interacting with various Geovision devices on the network, the utility may send privileged commands; in order to do so, the username and password of the device need to be provided. In some instances the command is broadcasted over UDP and the username/password are encrypted using a cryptographic protocol that appears to be derivated from Blowfish. However the symmetric key used for the encryption is also included in the packet, and thus the security of the username/password only relies on the \"obscurity\" of the encryption scheme. An attacker on the same LAN can listen to the broadcast traffic once an admin user interacts with the device, and decrypt the credentials using their own implementation of the algorithm. With this password the attacker would have full control over the device configuration, allowing them to change its ip address or even reset it to factory default.</div>"}]}], "references": [{"url": "https://www.geovision.com.tw/cyber_security.php", "tags": ["vendor-advisory"]}, {"url": "https://talosintelligence.com/vulnerability_reports/", "tags": ["third-party-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H"}}], "solutions": [{"lang": "en", "value": "GeoVision GV-IP Device Utility Device Authentication version 9.0.7.0 has patched reported vulnerability.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "GeoVision GV-IP Device Utility Device Authentication version 9.0.7.0 has patched reported vulnerability.&nbsp;"}]}], "credits": [{"lang": "en", "value": "Philippe Laulheret of Cisco Talos.", "type": "finder"}, {"lang": "en", "value": "Kelly Patterson of Cisco Talos.", "type": "remediation reviewer"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-27T13:19:02.425680Z", "id": "CVE-2026-42363", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T13:30:33.786Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42363", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-27T13:19:02.425680Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T13:19:03.687Z"}}], "cna": {"title": "GeoVision GV-IP Device Utility Device Authentication insufficient encryption vulnerability", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Philippe Laulheret of Cisco Talos."}, {"lang": "en", "type": "remediation reviewer", "value": "Kelly Patterson of Cisco Talos."}], "impacts": [{"capecId": "CAPEC-158", "descriptions": [{"lang": "en", "value": "CAPEC-158 Sniffing Network Traffic"}]}, {"capecId": "CAPEC-37", "descriptions": [{"lang": "en", "value": "CAPEC-37 Retrieve Embedded Sensitive Data"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "GeoVision Inc.", "product": "GV-IP Device Utility", "versions": [{"status": "affected", "version": "9.0.5.0"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "GeoVision GV-IP Device Utility Device Authentication version 9.0.7.0 has patched reported vulnerability.", "supportingMedia": [{"type": "text/html", "value": "GeoVision GV-IP Device Utility Device Authentication version 9.0.7.0 has patched reported vulnerability.&nbsp;", "base64": false}]}], "datePublic": "2026-04-27T00:00:00.000Z", "references": [{"url": "https://www.geovision.com.tw/cyber_security.php", "tags": ["vendor-advisory"]}, {"url": "https://talosintelligence.com/vulnerability_reports/", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "An insufficient encryption vulnerability exists in the Device Authentication functionality of GeoVision GV-IP Device Utility 9.0.5. Listening to broadcast packets can lead to credentials leak. An attacker can listen to broadcast messages to trigger this vulnerability.\n\n\nWhen interacting with various Geovision devices on the network, the utility may send privileged commands; in order to do so, the username and password of the device need to be provided. In some instances the command is broadcasted over UDP and the username/password are encrypted using a cryptographic protocol that appears to be derivated from Blowfish. However the symmetric key used for the encryption is also included in the packet, and thus the security of the username/password only relies on the \"obscurity\" of the encryption scheme. An attacker on the same LAN can listen to the broadcast traffic once an admin user interacts with the device, and decrypt the credentials using their own implementation of the algorithm. With this password the attacker would have full control over the device configuration, allowing them to change its ip address or even reset it to factory default.", "supportingMedia": [{"type": "text/html", "value": "An insufficient encryption vulnerability exists in the Device Authentication functionality of GeoVision GV-IP Device Utility 9.0.5. Listening to broadcast packets can lead to credentials leak. An attacker can listen to broadcast messages to trigger this vulnerability.<div><br></div><div>When interacting with various Geovision devices on the network, the utility may send privileged commands; in order to do so, the username and password of the device need to be provided. In some instances the command is broadcasted over UDP and the username/password are encrypted using a cryptographic protocol that appears to be derivated from Blowfish. However the symmetric key used for the encryption is also included in the packet, and thus the security of the username/password only relies on the \"obscurity\" of the encryption scheme. An attacker on the same LAN can listen to the broadcast traffic once an admin user interacts with the device, and decrypt the credentials using their own implementation of the algorithm. With this password the attacker would have full control over the device configuration, allowing them to change its ip address or even reset it to factory default.</div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-656", "description": "CWE-656 - Reliance on Security Through Obscurity"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:geovision_inc.:gv-ip_device_utility:9.0.5.0:*:windows:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "shortName": "GV", "dateUpdated": "2026-04-26T23:58:49.334Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42363", "state": "PUBLISHED", "dateUpdated": "2026-04-27T13:30:33.786Z", "dateReserved": "2026-04-26T23:39:08.350Z", "assignerOrgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "datePublished": "2026-04-26T23:58:49.334Z", "assignerShortName": "GV"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "GV-IP Device Utility", "vendor": "GeoVision Inc.", "versions": [{"status": "affected", "version": "9.0.5.0"}]}], "source": "0df08a0e-a200-4957-9bb0-084f562506f9"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An insufficient encryption vulnerability exists in the Device Authentication functionality of GeoVision GV-IP Device Utility 9.0.5. Listening to broadcast packets can lead to credentials leak. An attacker can listen to broadcast messages to trigger this vulnerability.\n\n\nWhen interacting with various Geovision devices on the network, the utility may send privileged commands; in order to do so, the username and password of the device need to be provided. In some instances the command is broadcasted over UDP and the username/password are encrypted using a cryptographic protocol that appears to be derivated from Blowfish. However the symmetric key used for the encryption is also included in the packet, and thus the security of the username/password only relies on the \"obscurity\" of the encryption scheme. An attacker on the same LAN can listen to the broadcast traffic once an admin user interacts with the device, and decrypt the credentials using their own implementation of the algorithm. With this password the attacker would have full control over the device configuration, allowing them to change its ip address or even reset it to factory default."}, {"lang": "es", "value": "Una vulnerabilidad de cifrado insuficiente existe en la funcionalidad de autenticaci\u00f3n de dispositivos de GeoVision GV-IP Device Utility 9.0.5. Escuchar paquetes de difusi\u00f3n puede llevar a una fuga de credenciales. Un atacante puede escuchar mensajes de difusi\u00f3n para activar esta vulnerabilidad.\n\nAl interactuar con varios dispositivos Geovision en la red, la utilidad puede enviar comandos privilegiados; para hacerlo, el nombre de usuario y la contrase\u00f1a del dispositivo deben ser proporcionados. En algunos casos, el comando se difunde a trav\u00e9s de UDP y el nombre de usuario/contrase\u00f1a est\u00e1n cifrados utilizando un protocolo criptogr\u00e1fico que parece derivado de Blowfish. Sin embargo, la clave sim\u00e9trica utilizada para el cifrado tambi\u00e9n se incluye en el paquete, y por lo tanto la seguridad del nombre de usuario/contrase\u00f1a solo depende de la \u2019oscuridad\u2019 del esquema de cifrado. Un atacante en la misma LAN puede escuchar el tr\u00e1fico de difusi\u00f3n una vez que un usuario administrador interact\u00faa con el dispositivo, y descifrar las credenciales utilizando su propia implementaci\u00f3n del algoritmo. Con esta contrase\u00f1a, el atacante tendr\u00eda control total sobre la configuraci\u00f3n del dispositivo, permiti\u00e9ndoles cambiar su direcci\u00f3n IP o incluso restablecerlo a los valores predeterminados de f\u00e1brica."}], "id": "CVE-2026-42363", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.8, "source": "0df08a0e-a200-4957-9bb0-084f562506f9", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42363", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-27T13:19:02.425680Z", "version": "2.0.3"}}]}, "published": "2026-04-27T00:16:20.357", "references": [{"source": "0df08a0e-a200-4957-9bb0-084f562506f9", "url": "https://talosintelligence.com/vulnerability_reports/"}, {"source": "0df08a0e-a200-4957-9bb0-084f562506f9", "url": "https://www.geovision.com.tw/cyber_security.php"}], "sourceIdentifier": "0df08a0e-a200-4957-9bb0-084f562506f9", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-656"}], "source": "0df08a0e-a200-4957-9bb0-084f562506f9", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["windows"], "status": "affected", "versions": {"scheme": "generic", "value": "9.0.5.0"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 92.0, "source": "matching"}]}, "original": {"product": "GV-IP Device Utility", "source": "cna", "vendor": "GeoVision Inc."}, "product": "gv-ip_device_utility", "vendor": "geovision_inc."}], "analysis": {"en": {"generated_at": "2026-04-28T05:01:00.434509+00:00", "value": {"mitigation_remediation": ["Apply the GeoVision GV-IP Device Utility update to version 9.0.7.0 or newer. ", "Configure the device to disable or restrict UDP broadcast commands, ensuring that privileged instructions are only sent over secure, unicast channels. ", "Implement network segmentation or VLAN isolation so that the device\u2019s broadcast traffic is not accessible to unauthorized LAN users. ", "Activate and review device logging for unauthorized configuration changes, and forward logs to a secure, monitored syslog server."], "summary": {"action": "Immediate Patch", "impact": "Credential theft leading to full device control"}, "threat_synthesis": {"affected_systems": "The vulnerability affects GeoVision Inc.'s GV-IP Device Utility, specifically version 9.0.5.0 and earlier releases that employ the described broadcast authentication process. The vendor has released 9.0.7.0 as a patch to address this issue.", "description_and_impact": "GeoVision GV-IP Device Utility 9.0.5.0 uses an encryption scheme derived from Blowfish to protect device credentials, but the symmetric key is transmitted alongside the encrypted username and password in broadcast UDP packets. An attacker on the same LAN can capture these packets, decrypt the credentials using a known implementation of the algorithm, and obtain full administrative control over the device. With such credentials an attacker can alter the device\u2019s network configuration, reset it to factory defaults, or otherwise execute arbitrary privileged commands, effectively compromising the device\u2019s integrity and availability.", "risk_and_exploitability": "The CVSS score of 9.3 reflects a severe impact, while the EPSS score of < 1% indicates that exploit attempts are currently rare. The vulnerability is not listed in CISA\u2019s KEV catalog. The attack vector is inferred to be a local LAN attacker able to observe broadcast traffic; thus an attacker who can join the same network segment or sniff broadcast packets could leverage this flaw with minimal prerequisites."}}}}, "created": "2026-04-27T20:15:12.097207+00:00", "updated": "2026-04-28T05:15:22.932136+00:00", "vendors": ["geovision_inc.", "geovision_inc.$PRODUCT$gv-ip_device_utility"]}