Gv Lpclpc2011 2211 CVE-2026-57876

GeoVision GV-LPC2011 and GV-LPC2211 license plate recognition cameras running firmware V1.12 and earlier are vulnerable to remote denial-of-service attacks that disable these security-critical devices without authentication. A single malformed HTTP request can crash the camera, blocking organizations' ability to process license plate data until manual recovery. For organizations operating these devices in access control, law enforcement, or parking enforcement environments, the risk directly threatens operational continuity and security posture.

Within 24 hours: Conduct inventory of all affected GeoVision devices; identify those running firmware V1.12 or earlier; restrict network access to ONVIF CGI endpoints through firewall rules or network segmentation. Within 7 days: Deploy compensating controls (HTTP request validation, body size limits, or Web Application Firewall rules on ONVIF interfaces); establish automated monitoring for device unavailability; test manual restart procedures. Within 30 days: Initiate vendor communication to track patch release timeline; develop and validate firmware upgrade procedure including rollback plan; schedule production implementation upon patch availability.

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Network segmentation-restrict ONVIF interface access to authorized administrative networks only; (2) Web Application Firewall with HTTP request validation and body size enforcement on ONVIF endpoints; (3) Disable ONVIF protocol if operationally feasible; (4) Implement automated availability monitoring with alerting for unexpected device restarts; (5) Document and maintain manual restart procedures as an operational workaround.