What is the CVSS score of CVE-2026-57876?

CVE-2026-57876 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Gv Lpclpc2011 2211 are affected by CVE-2026-57876?

GeoVision GV-LPC2011 and GV-LPC2211 license plate recognition cameras running firmware V1.12 and earlier are vulnerable to remote denial-of-service attacks that disable these security-critical…

How to fix or mitigate CVE-2026-57876?

Within 24 hours: Conduct inventory of all affected GeoVision devices; identify those running firmware V1.12 or earlier; restrict network access to ONVIF CGI endpoints through firewall rules or network segmentation. Within 7 days: Deploy compensating controls (HTTP request validation, body size limits, or Web Application Firewall rules on ONVIF interfaces); establish automated monitoring for device unavailability; test manual restart procedures. Within 30 days: Initiate vendor communication to track patch release timeline; develop and validate firmware upgrade procedure including rollback plan; schedule production implementation upon patch availability.

Gv Lpclpc2011 2211 CVE-2026-57876

EUVD-2026-39632 HIGH

Out-of-bounds Write (CWE-787)

2026-06-26 GV

GHSA-9qp6-g7r6-cvp4

Buffer Overflow Denial Of Service Memory Corruption Gv Lpclpc2011 2211 Geovision Inc

7.5

CVSS 3.1 · Vendor: GV

Severity by source

Vendor (GV) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (GV) · only source for this CVE.

CVSS VectorVendor: GV

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 08:17 vuln.today

DescriptionCVE.org

An unauthenticated out-of-bounds write vulnerability exists in onvif.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when processing HTTP request body data. A remote attacker may exploit this vulnerability by sending a crafted request with excessive input, causing memory corruption and resulting in a denial of service.

AnalysisAI

Denial of service in GeoVision GV-LPC2011 and GV-LPC2211 license plate recognition cameras (firmware V1.12 and earlier) lets remote, unauthenticated attackers crash the device by sending a crafted HTTP request to onvif.cgi. The ONVIF CGI handler fails to bounds-check HTTP request body data, so oversized input triggers an out-of-bounds write and memory corruption. No public exploit identified at time of analysis, and the flaw yields availability impact only — no code execution or data disclosure is claimed by the vendor.