GeoVision GV-IP Device Utility version 9.0.5.0 suffers from a vulnerability classified as CWE-656 (Reliance on Security Through Obscurity). The device authentication mechanism sends privileged commands over UDP broadcasts, encrypting usernames and passwords with a Blowfish-derived symmetric encryption. However, the symmetric key used for encryption is transmitted within the same packet, allowing an attacker on the local network to intercept and decrypt the credentials. This enables unauthorized full control over the device, including configuration changes and factory resets. The vulnerability is publicly disclosed with a CVSS 3.1 score of 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H). No vendor patch or official remediation is currently documented.

An attacker on the same local network can capture broadcast packets containing encrypted device credentials and decrypt them due to the inclusion of the symmetric key in the packet. This leads to a complete compromise of device authentication, allowing the attacker to change device settings such as IP address or reset the device to factory defaults. The vulnerability impacts confidentiality and availability but does not affect integrity directly. The high CVSS score reflects the ease of exploitation and the critical impact on device control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to trusted users only and avoid using the vulnerable utility on untrusted or public networks. Monitor for unusual device configuration changes as a precaution. Do not rely on the current encryption scheme for protecting credentials.