CVE-2026-42363 - Vulnerability Analysis

Overview

GeoVision GV-IP Device Utility 9.0.5 contains an insufficient encryption vulnerability in Device Authentication caused by including the symmetric key in broadcast packets, letting attackers on the same LAN decrypt credentials and gain full device control, exploit requires attacker to be on the same LAN and an admin user to interact with the device.

Severity & Score

Impact

Attackers on the same LAN can decrypt credentials, gaining full control over device configuration including IP changes and factory reset.

Mitigation

Update to the latest version with improved encryption or contact vendor for patches.

References

• https://talosintelligence.com/vulnerability_reports/
• https://www.geovision.com.tw/cyber_security.php

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner