CVE-2026-7161 -- CVSS 9.3 Vulnerability Briefing

CVE-2026-7161 | CVSS 9.3 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-7161 is an insufficient encryption vulnerability in the Device Authentication functionality of GeoVision GV-IP Device Utility version 9.0.5, a network device management utility used to discover and configure GeoVision IP devices on a local network.

Technical Detail

The flaw exists in how the GV-IP Device Utility handles authentication credentials transmitted over broadcast packets during the device discovery and authentication process. An attacker positioned on the same network segment can passively listen to these broadcast packets and recover plaintext or weakly protected credentials due to the absence of adequate encryption. Successful exploitation results in credential disclosure, which could allow an attacker to authenticate to managed GeoVision IP devices and gain unauthorized access to those systems.

Exploitation Status

No known exploit code has been publicly identified for this vulnerability at this time. The exploit maturity is currently assessed as none. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. Despite the absence of confirmed exploitation, the passive nature of the attack (network sniffing) lowers the practical barrier for abuse on unsegmented networks.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns or targeted sectors have been associated with this vulnerability. Given that GeoVision devices are commonly deployed in physical security and surveillance environments, organizations in those sectors should treat this as a relevant exposure even in the absence of confirmed targeting.

What To Do

Organizations running GeoVision GV-IP Device Utility 9.0.5 should check with GeoVision for an updated version that addresses this encryption deficiency and apply any available patch promptly given the critical CVSS score of 9.3. As an immediate workaround, restrict network access to segments where the GV-IP Device Utility operates by placing device management traffic on isolated VLANs and enforcing strict access controls to prevent unauthorized hosts from monitoring broadcast traffic. Network monitoring tools should be configured to alert on unexpected broadcast listeners or anomalous authentication traffic on segments hosting GeoVision devices. If no patch is yet available, consider disabling the broadcast-based discovery feature if operationally feasible until a fix is confirmed.