CVE-2026-7161

{
  "id": "CVE-2026-7161",
  "sourceIdentifier": "0df08a0e-a200-4957-9bb0-084f562506f9",
  "published": "2026-05-04T01:16:04.447",
  "lastModified": "2026-10-26T20:10:00.160",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An insufficient encryption vulnerability exists in the Device Authentication functionality of GeoVision GV-IP Device Utility 9.0.5. Listening to broadcast packets can lead to credentials leak. An attacker can listen to broadcast messages to trigger this vulnerability.\n\n\nWhen interacting with various Geovision devices on the network, the utility may send privileged commands; in order to do so, the username and password of the device need to be provided. In some instances the command is broadcasted over UDP and the username/password are encrypted using a cryptographic protocol that appears to be derivated from Blowfish. However the symmetric key used for the encryption is also included in the packet, and thus the security of the username/password only relies on the \"obscurity\" of the encryption scheme. An attacker on the same LAN can listen to the broadcast traffic once an admin user interacts with the device, and decrypt the credentials using their own implementation of the algorithm. With this password the attacker would have full control over the device configuration, allowing them to change its ip address or even reset it to factory default."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de cifrado insuficiente en la funcionalidad de autenticación de dispositivos de GeoVision GV-IP Device Utility 9.0.5. Escuchar paquetes de difusión puede llevar a una fuga de credenciales. Un atacante puede escuchar mensajes de difusión para activar esta vulnerabilidad.\n\nAl interactuar con varios dispositivos Geovision en la red, la utilidad puede enviar comandos privilegiados; para ello, deben proporcionarse el nombre de usuario y la contraseña del dispositivo. En algunos casos, el comando se difunde por UDP y el nombre de usuario/contraseña están cifrados utilizando un protocolo criptográfico que parece derivado de Blowfish. Sin embargo, la clave simétrica utilizada para el cifrado también se incluye en el paquete, y por lo tanto la seguridad del nombre de usuario/contraseña solo depende de la ’oscuridad’ del esquema de cifrado. Un atacante en la misma LAN puede escuchar el tráfico de difusión una vez que un usuario administrador interactúa con el dispositivo, y descifrar las credenciales utilizando su propia implementación del algoritmo. Con esta contraseña, el atacante tendría control total sobre la configuración del dispositivo, permitiéndoles cambiar su dirección IP o incluso restablecerlo a los valores predeterminados de fábrica."
    }
  ],
  "affected": [
    {
      "source": "0df08a0e-a200-4957-9bb0-084f562506f9",
      "affectedData": [
        {
          "vendor": "GeoVision Inc.",
          "product": "GV-IP Device Utility",
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "versions": [
            {
              "version": "9.0.5.0",
              "status": "affected"
            },
            {
              "version": "9.0.7.0",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "0df08a0e-a200-4957-9bb0-084f562506f9",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H",
          "baseScore": 9.3,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.8
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-05T03:56:17.236234Z",
          "id": "CVE-2026-7161",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "0df08a0e-a200-4957-9bb0-084f562506f9",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-656"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:geovision:gv-ip_device_utility:9.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "B69010CB-82BF-4F0C-83C6-1EDFF720EC3D"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://talosintelligence.com/vulnerability_reports/",
      "source": "0df08a0e-a200-4957-9bb0-084f562506f9",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.geovision.com.tw/cyber_security.php",
      "source": "0df08a0e-a200-4957-9bb0-084f562506f9",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2322",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}