What is the CVSS score of CVE-2026-57874?

CVE-2026-57874 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of GeoVision GV-LPC are affected by CVE-2026-57874?

GeoVision license-plate-capture devices (GV-LPC2011 and GV-LPC2211, firmware V1.12 and earlier) are vulnerable to remote denial-of-service attacks that disable traffic monitoring and license-plate…

How to fix or mitigate CVE-2026-57874?

24 hours: Identify and inventory all GeoVision GV-LPC2011 and GV-LPC2211 devices running firmware V1.12 or earlier; block external network access to the IEEE8021x_upload.cgi endpoint. 7 days: Implement firewall rules or layer-3 network segmentation to restrict connectivity to affected devices to trusted management networks only. 30 days: Contact GeoVision to confirm firmware availability status; initiate device replacement procurement if vendor does not release a patch within 60 days.

GeoVision GV-LPC CVE-2026-57874

EUVD-2026-39630 HIGH

Classic Buffer Overflow (CWE-120)

2026-06-26 GV

GHSA-vrjw-2c7c-hhv6

Buffer Overflow Denial Of Service Gv Lpclpc2011 2211 Geovision Inc

7.5

CVSS 3.1 · Vendor: GV

Severity by source

Vendor (GV) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable CGI with a low-complexity long-filename trigger gives AV:N/AC:L/PR:N/UI:N; description limits impact to a crash, so A:H with C:N/I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GV).

CVSS VectorVendor: GV

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 08:16 vuln.today

DescriptionCVE.org

An unauthenticated buffer overflow vulnerability exists in IEEE8021x_upload.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when parsing filename values in multipart upload data. A remote attacker may exploit this vulnerability by sending a crafted upload request with overly long input, causing memory corruption and resulting in a denial of service.

AnalysisAI

Denial of service in GeoVision GV-LPC2011 and GV-LPC2211 license-plate-capture devices (firmware V1.12 and earlier) allows remote unauthenticated attackers to crash the device by sending a multipart upload request with an overly long filename to IEEE8021x_upload.cgi. The flaw is a classic stack/heap buffer overflow (CWE-120) with availability-only impact and no confidentiality or integrity loss. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The affected component, IEEE8021x_upload.cgi, is a CGI endpoint in GeoVision's embedded camera/appliance web interface used to upload IEEE 802.1X certificate or configuration files. The vulnerability is a CWE-120 buffer copy without checking input size: the CGI parses the filename field of multipart/form-data upload payloads and copies it into a fixed-size buffer without validating length, allowing an attacker-controlled string to overrun adjacent memory. GeoVision GV-LPC2011/GV-LPC2211 are license plate capture/recognition camera appliances (CPE cpe:2.3:a:geovision_inc.:gv-lpclpc2011/2211), typically running a lightweight embedded HTTP server where a single CGI crash can take down the management service or the whole device.

RemediationAI

Apply the updated firmware released by GeoVision for the GV-LPC2011/GV-LPC2211 series as published on the vendor advisory at https://www.geovision.com.tw/cyber_security.php - no exact fixed version is specified in the available data, so confirm the patched build directly with GeoVision (no vendor-released patch version identified at time of analysis). As compensating controls until patched, remove the device web/management interface from internet exposure and restrict access to the management network or a VPN; block external access to the HTTP(S) management port and specifically restrict the IEEE8021x_upload.cgi endpoint via an upstream proxy or firewall ACL so untrusted clients cannot reach it. These controls reduce the remote attack surface but will also block legitimate remote administration and any 802.1X certificate upload workflow that relies on that endpoint, so plan management access accordingly.