The GeoVision GV-IP Device Utility version 9.0.7.0 contains an uncontrolled search path element vulnerability (CWE-427) where the application loads DLLs from an unsafe search path. This allows a local attacker with limited privileges to place a malicious DLL in a directory that the application searches before the legitimate DLL location, resulting in DLL hijacking or side-loading. Exploitation can lead to full compromise of the application’s security properties including confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can result in execution of arbitrary code with the privileges of the user running the application. This can lead to complete compromise of confidentiality, integrity, and availability of the affected system. The CVSS v3.1 base score is 7.3 (High), reflecting local attack vector with low complexity, requiring low privileges but user interaction, and resulting in high impact on confidentiality, integrity, and availability.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should restrict local access to trusted users only and avoid running the vulnerable application in untrusted environments. Monitor vendor communications for updates and apply any official fixes once available.