GeoVision GV-IP Device Utility version 9.0.5 suffers from a vulnerability where device authentication credentials are encrypted with a symmetric key derived from Blowfish but the key is transmitted alongside the encrypted data in broadcast UDP packets. This design flaw means the encryption provides no real security, allowing an attacker on the local network to intercept and decrypt administrative credentials. With these credentials, an attacker can issue privileged commands to the device, potentially altering its configuration or resetting it.

An attacker with network access to the same LAN can capture broadcast packets containing encrypted credentials and the encryption key, decrypt the credentials, and gain administrative control over affected GeoVision devices. This can lead to unauthorized configuration changes, including IP address modification or factory reset, which can disrupt device availability and security. The vulnerability has a CVSS score of 9.3, indicating critical severity with high confidentiality impact and high availability impact.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, limit network access to the utility and devices to trusted users only and avoid using the utility on untrusted or public networks. Monitor vendor communications for updates or patches addressing this issue.