What is the CVSS score of CVE-2026-57875?

CVE-2026-57875 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 1.3%.

Which versions of GeoVision GV-LPC2011 are affected by CVE-2026-57875?

GeoVision license-plate capture devices (GV-LPC2011/GV-LPC2211, firmware V1.12 and earlier) are vulnerable to remote denial-of-service attacks from unauthenticated attackers that crash the device…

How to fix or mitigate CVE-2026-57875?

Within 24 hours: Inventory all GV-LPC2011 and GV-LPC2211 devices and document their current firmware version and network location. Within 7 days: Implement network access controls restricting HTTP access to these devices to authorized management IPs only, and deploy WAF rules to block malformed HTTP requests to the CGI interface. Within 30 days: Contact GeoVision for available firmware updates; if no patch is released, develop a device replacement or upgrade plan for current-generation models.

GeoVision GV-LPC2011 CVE-2026-57875

EUVD-2026-39631 HIGH

NULL Pointer Dereference (CWE-476)

2026-06-26 GV

GHSA-9hv4-r5p9-3gf6

Denial Of Service Null Pointer Dereference Gv Lpclpc2011 2211

7.5

CVSS 3.1 · Vendor: GV

Severity by source

Vendor (GV) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote, no-auth, low-complexity HTTP request triggers a crash (AV:N/AC:L/PR:N/UI:N); impact is availability-only DoS, so C:N/I:N/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GV).

CVSS VectorVendor: GV

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 08:16 vuln.today

DescriptionCVE.org

An unauthenticated NULL pointer dereference vulnerability exists in the HTTP request parsing logic of multiple CGI components in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by improper validation of required HTTP request metadata before it is used by the affected components. A remote attacker may exploit this vulnerability by sending a specially crafted HTTP request, causing the affected process to crash and resulting in a denial of service.

AnalysisAI

Denial of service in GeoVision GV-LPC2011 and GV-LPC2211 license-plate capture devices (firmware V1.12 and earlier) lets a remote, unauthenticated attacker crash the device by sending a single malformed HTTP request to its CGI interface. The flaw is a NULL pointer dereference in HTTP request-parsing logic shared across multiple CGI components, triggered when required request metadata is missing or malformed. No public exploit identified at time of analysis, and the issue has no confidentiality or integrity impact - only availability.

Technical ContextAI

The affected devices are GeoVision GV-LPC (License Plate Capture/Recognition) embedded camera/controller units that expose a web management interface backed by CGI components. CWE-476 (NULL Pointer Dereference) describes the root cause: the CGI HTTP parser reads pointers derived from request metadata (such as headers or content fields) without first validating that those values are present and non-null, then dereferences them. When an attacker omits or corrupts that expected metadata, the process dereferences a NULL pointer and crashes. Because the same defective parsing routine is reused across several CGI endpoints, multiple request paths can reach the bug, increasing the attack surface on the embedded HTTP service.

RemediationAI

No vendor-released patch version is identified in the available data; the only reference is GeoVision's general security advisory page (https://www.geovision.com.tw/cyber_security.php), which should be checked for a firmware build newer than V1.12 and applied once available. As compensating controls until a fixed firmware is confirmed: remove the devices' web/CGI interface from internet exposure and place them on a segmented management VLAN, restricting TCP access to the HTTP(S) management port to a small set of trusted administrative hosts via firewall ACLs (trade-off: legitimate remote management must come through a VPN or jump host). Place a reverse proxy or WAF in front of the CGI interface to enforce well-formed HTTP requests and reject those missing required headers/metadata (trade-off: added latency and maintenance, and it may not block every malformed-request variant). Monitor for unexpected device reboots/crashes as a detection signal, since exploitation manifests as service disruption.