# CVE-2026-42363: GeoVision GV-IP Device Utility insufficient encryption in Device Authentication

Source: https://junglewise.ai/threats/cve-2026-42363-geovision-gv-ip-device-utility-insufficient-encryption-in-device  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-27. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2026-42363 · Severity: critical · CVSS 9.3 · Published 2026-04-27

A security vulnerability exists in the GeoVision GV-IP Device Utility, a tool used to manage and configure GeoVision IP cameras and surveillance hardware. When an administrator uses the utility to send commands, the software transmits sensitive login credentials over the local network using weak encryption that includes the decryption key within the message itself. An attacker on the same local network can intercept these messages to steal usernames and passwords, potentially gaining full control over the security cameras, including the ability to change settings or reset devices to factory defaults.

Technologies: [Geovision GV-IP Device Utility](https://junglewise.ai/threats/technologies/gv-ip-device-utility). Vendors: [Geovision](https://junglewise.ai/threats/vendors/geovision).

## Quick answers

**Is CVE-2026-42363 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42363 being exploited in the wild.

**How severe is CVE-2026-42363?** Critical severity, with a CVSS score of 9.3, published 27 April 2026.

**Which products and versions are affected?** Geovision GV-IP Device Utility 9.0.5.

**Is there a fix for CVE-2026-42363?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-42363 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-42363?** Check whether you run Geovision GV-IP Device Utility at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An insufficient encryption vulnerability (CWE-656) exists in GeoVision GV-IP Device Utility 9.0.5. When the utility sends privileged commands to devices, it broadcasts UDP packets containing the username and password. While the credentials are encrypted using a protocol derived from Blowfish, the symmetric encryption key is included within the same packet. An attacker on the same LAN can capture this broadcast traffic, extract the key, and decrypt the credentials. This allows for unauthorized administrative access to GeoVision devices, enabling attackers to modify IP configurations or perform factory resets. The vulnerability is triggered when an authenticated user interacts with the device via the utility.

## Affected products

- GeoVision GV-IP Device Utility 9.0.5

## Timeline

- 2026-04-27: advisory: NVD and vendor advisory published

## References

- [https://talosintelligence.com/vulnerability_reports/](https://talosintelligence.com/vulnerability_reports/)
- [https://www.geovision.com.tw/cyber_security.php](https://www.geovision.com.tw/cyber_security.php)

## Related threats

- [GeoVision GV-IP Device Utility DLL hijacking](https://junglewise.ai/threats/cve-2026-16519-geovision-gv-ip-device-utility-dll-hijacking)
- [GeoVision GV-IP Device Utility insufficient encryption in Device Authentication](https://junglewise.ai/threats/cve-2026-7161-geovision-gv-ip-device-utility-insufficient-encryption-in-device)