CVE-2026-42363: GeoVision GV-IP Device Utility: Insufficient Encryption Exposes Device Credentials

Overview

CVE-2026-42363 is described as an insufficient encryption issue in the Device Authentication feature of GeoVision GV-IP Device Utility 9.0.5. The record states that device credentials carried in certain UDP broadcast packets can be exposed to anyone who can listen to that traffic on the same network segment. The CWE assigned in the record is CWE-656.

Impact

According to the record, a successful recovery of the username and password could give an attacker full control over the device configuration, including changing its IP address or resetting it to factory defaults. The CVSS 3.1 score in the record is 9.3, with a vector that indicates network attack, low complexity, no privileges required, user interaction required, scope change, and high confidentiality, integrity and availability impact. Because the record describes the attack as requiring a LAN position, the practical exposure is most relevant to networks where untrusted parties can reach the broadcast domain.

Affected products and versions

• Product named in the record: GeoVision GV-IP Device Utility 9.0.5.
• The record lists no structured affected version ranges and no fixed versions.
• The record notes that the utility interacts with various GeoVision devices, but it does not enumerate which device models or firmware versions are affected.

Exploitation status

The CISA Known Exploited Vulnerabilities catalog does not list this CVE in the data provided, so active exploitation is not confirmed by that source. No confirmed exploitation was found in the sources consulted for this analysis. The EPSS probability in the record is 0.0031, with a percentile of 0.22135.

Remediation and mitigation

• Check the vendor security page referenced in the record for an updated utility or device firmware and apply it as soon as it is validated for your environment.
• Until a fix is confirmed, limit access to the management utility and the devices it manages, and avoid using it from segments where untrusted hosts can observe broadcast traffic.
• Use separate administrative networks or VLANs for device management, and restrict broadcast traffic from management segments where operationally possible.
• Change device credentials after any suspected exposure and review device configuration for unexpected IP or factory-reset events.

Detection guidance

• Review network monitoring for unusual UDP broadcast traffic associated with GeoVision management activity, and for unexpected devices on the same segment that capture such traffic.
• Audit device logs and configuration for unplanned changes to network settings or resets to default.
• Treat any unexplained device configuration change as a potential security incident and verify credentials on affected devices.

Limitations of the available information

• The record has no structured affected version data and no fixed version, so the scope of vulnerable releases is unknown.
• The record's CNA status is shown as Deferred, and the referenced vendor page and Talos vulnerability report index were not analyzed in detail for this summary.
• The record does not provide a CWE name, KEV details, or SSVC data.
• The exact device models that use the affected broadcast mechanism are not specified in the record.

Frequently asked questions

What is CVE-2026-42363?

It is an insufficient encryption issue in the Device Authentication feature of GeoVision GV-IP Device Utility 9.0.5, where credentials in certain UDP broadcast packets may be recoverable by a party on the same LAN.

Is this CVE being actively exploited?

The KEV catalog data in the record does not list it, and no confirmed exploitation was found in the sources consulted.

Which version is fixed?

The record does not list any fixed version, so the fix status is unknown. Check the vendor security page referenced in the record.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.