GeoVision GV-IP Device Utility version 9.0.5 suffers from an insufficient encryption vulnerability (CWE-656) in its device authentication mechanism. When sending privileged commands to devices on the network, the utility broadcasts username and password credentials encrypted with a scheme derived from Blowfish. However, the symmetric key used for encryption is included in the broadcast packet itself, making the encryption ineffective. An attacker on the same local network can capture these broadcast packets, extract the symmetric key, decrypt the credentials, and gain administrative control over the devices. This vulnerability allows unauthorized configuration changes and device resets.

An attacker with access to the same local network can intercept broadcast packets containing encrypted credentials and decrypt them due to the exposure of the symmetric key in the packet. This leads to credential compromise, enabling the attacker to fully control affected devices by changing their IP addresses or resetting them to factory defaults. The vulnerability impacts confidentiality and availability of the devices but does not directly affect integrity according to the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to trusted users only and avoid using the vulnerable utility on untrusted or public networks. Monitor for unusual device configuration changes as a precaution.