The vulnerability in GeoVision GV-IP Device Utility 9.0.5 arises from an insufficient encryption mechanism in the Device Authentication functionality. When the utility sends privileged commands over UDP broadcast, it encrypts the username and password with a cryptographic protocol derived from Blowfish. However, the symmetric key used for encryption is also transmitted within the same packet, making the encryption ineffective. An attacker on the same local network can capture these broadcast packets, extract the key, decrypt the credentials, and gain administrative access to the device. This allows the attacker to alter device settings or reset the device to factory defaults. The CVSS 3.1 score is 9.3, indicating a critical severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, high confidentiality impact, no integrity impact, and high availability impact.

An attacker on the same LAN can intercept broadcast packets containing encrypted credentials along with the encryption key, allowing them to decrypt and obtain administrative credentials. This leads to full control over the device configuration, enabling changes to IP addresses or resetting the device to factory defaults. The vulnerability compromises confidentiality and availability of the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch has been published as of the information available. Until a patch is released, restrict network access to trusted users only and avoid using the utility on untrusted or public networks to reduce exposure. Monitor for updates from GeoVision Inc. regarding remediation.