CVE-2026-7161 GeoVision Inc. CVE debrief

Who should care

Administrators and users of GeoVision GV-IP Device Utility 9.0.5 should be aware of this critical vulnerability and take immediate action to mitigate the risk.

Technical summary

The vulnerability exists in the Device Authentication functionality of GeoVision GV-IP Device Utility 9.0.5. When interacting with various Geovision devices on the network, the utility sends privileged commands, which require the username and password of the device. In some instances, the command is broadcasted over UDP, and the username/password are encrypted using a cryptographic protocol derived from Blowfish. However, the symmetric key used for encryption is also included in the packet, making the security of the username/password rely only on the 'obscurity' of the encryption scheme.

Defensive priority

High

Recommended defensive actions

• Apply patches or updates provided by the vendor (see resourceLinkAnnotations 'ref-5')
• Use secure communication protocols for device authentication
• Limit access to device configuration to authorized personnel only
• Monitor network traffic for suspicious activity

Evidence notes

CVE-2026-7161 has a CVSS score of 9.3 and is classified as CRITICAL. The vulnerability was published on May 4, 2026, and last modified on June 15, 2026.

Official resources