GeoVision GV-LPC2011 CVE-2026-57875

Exploitation requires only network reachability to the HTTP/CGI management interface of a GeoVision GV-LPC2011 or GV-LPC2211 running firmware V1.12 or earlier - per AV:N/AC:L/PR:N/UI:N there is no authentication, user interaction, or special configuration prerequisite beyond the attacker being able to send an HTTP request to the device's web service. The concrete trigger is an HTTP request to an affected CGI component that omits or malforms the required request metadata the parser expects. The primary limiting factor is exposure: the device's web interface must be reachable from the attacker's network position, so units behind segmentation/firewalls or not internet-exposed are not remotely exploitable, and the impact is limited to a crash/denial of service with no data disclosure or code execution.

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent with the description: network-reachable, low complexity, no privileges, no user interaction, and an availability-only impact - a clean DoS profile, not code execution despite the HIGH score. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active exploitation or widespread weaponization; the 7.5 is driven entirely by easy reachability, not by data loss or compromise. Realistic priority is moderate and context-dependent: for an internet-exposed or perimeter-facing LPR deployment a trivially-triggerable remote crash matters, but the impact ceiling is a reboot/outage rather than takeover. EPSS data is missing, so probabilistic exploitation likelihood cannot be quantified from the provided input.

An attacker who can reach the device's HTTP management interface sends a single specially crafted request to one of the vulnerable CGI endpoints with required metadata omitted or malformed, causing the parser to dereference a NULL pointer and crash the process. The targeted GV-LPC unit drops offline (denial of service), interrupting license-plate capture; the attack needs no authentication and no user interaction, and can be repeated to keep the device down. No public exploit code is identified at time of analysis.