GeoVision GV-LPC CVE-2026-57874

Exploitation requires network reachability to the device's web management interface and the ability to send a multipart/form-data upload request to the IEEE8021x_upload.cgi endpoint with an overly long filename field - that crafted long filename IS the trigger condition. Per CVSS PR:N/UI:N, no authentication and no user interaction are required, and default configurations of the GV-LPC2011/GV-LPC2211 (V1.12 and earlier) are exploitable. The main limiting factor is exposure: the attacker must be able to route to the device's HTTP service, so devices placed behind a firewall or on an isolated management VLAN are not remotely exploitable. Impact is limited to denial of service; there is no indication of code execution or data access.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5 HIGH) reflects a remotely reachable, low-complexity, unauthenticated flaw whose only impact is availability - there is no code execution or data exposure claimed in the description, only memory corruption leading to denial of service. This is a real but bounded risk: it is trivially triggerable against exposed devices but yields only a crash/reboot, not compromise. There is no EPSS score, no SSVC decision, no KEV listing, and no POC in the provided data, so real-world exploitation pressure appears low and opportunistic rather than targeted. Note the description explicitly limits impact to 'memory corruption and resulting in a denial of service'; whether the overflow could be escalated to code execution is unproven and should not be assumed - verify with the vendor before treating this as RCE.

An attacker who can reach the device's web interface sends a single crafted HTTP multipart POST to IEEE8021x_upload.cgi with an excessively long filename value, overrunning the parsing buffer and crashing the service. No authentication or user interaction is required, so an attacker scanning for exposed GeoVision devices could repeatedly knock targeted cameras offline. No public POC is identified at this time.