GeoVision LPC2011/LPC2211 CVE-2026-42367

Exploitation requires low-privilege authenticated access to the GeoVision LPC2011/LPC2211 Web Interface (PR:L per CVSS vector). The attacker must be able to send HTTP requests to the ssi.cgi endpoint, which is accessible over the network (AV:N). No special configuration or non-default setup is implied by the description - the vulnerability exists in firmware 1.10 as shipped. The attack does not require user interaction (UI:N), meaning the attacker can unilaterally trigger credential leakage by sending a crafted request. Exploitation is limited to credential disclosure only (high confidentiality, no integrity or availability impact), so the attacker cannot directly modify device settings or disable functionality through this vulnerability alone but can escalate privileges to perform such actions with leaked credentials.

CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates moderate-to-high severity with network-accessible attack vector and low complexity, but requires low-privilege authenticated access. The confidentiality impact is high (credential leak), with no integrity or availability impact. The EPSS exploitation probability is not provided, limiting quantitative risk comparison. No KEV status or POC availability is noted in the source data. The credential disclosure mechanism is realistic for real-world impact - leaked credentials enable lateral movement, administrative account compromise, or service takeover - despite the 'authenticated access required' gate. The lack of public exploit data and KEV confirmation suggests limited but not negligible real-world exploitation. Organizations with exposed LPC2011/2211 devices on untrusted networks face elevated risk; internal-only deployment mitigates attack surface. The requirement for low-privilege access (e.g., a guest or analyst account) is a meaningful but not insurmountable barrier in multi-user surveillance systems.

An internal employee with guest-level credentials to a GeoVision LPC2211 camera management interface crafts a malicious HTTP request to the ssi.cgi endpoint that exploits improper access controls to retrieve stored administrative credentials. Using the leaked credentials, the attacker logs into the device with administrator privileges, modifies camera configurations, or exports footage. Alternatively, a threat actor gains low-privilege access via credential stuffing or social engineering, then exploits the vulnerability to escalate access without requiring additional user interaction.