GeoVision GV-IP Device Utility vulnerabilities

An insufficient encryption vulnerability exists in the Device Authentication functionality of GeoVision GV-IP Device Utility 9.0.5. Listening to broadcast packets can lead to credentials leak.

GeoVision GV-IP Device Utility 9.0.5 sends privileged commands via UDP broadcast, encrypting credentials with a Blowfish-like algorithm, but the symmetric key is included in the packet. An attacker on the same LAN can capture broadcast traffic and decrypt the credentials.

The GeoVision GV-IP Device Utility desktop application is vulnerable to DLL hijacking. It loads DLLs from an unsafe search path, allowing a local attacker to place a malicious DLL in a location searched before the legitimate library.