What is the CVSS score of CVE-2026-57878?

CVE-2026-57878 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of GeoVision GV-LPC are affected by CVE-2026-57878?

GeoVision license-plate recognition cameras (GV-LPC2011/GV-LPC2211) contain a critical remote code execution vulnerability that unauthenticated attackers can exploit remotely without user interaction…

How to fix or mitigate CVE-2026-57878?

Within 24 hours: Conduct inventory of all GeoVision GV-LPC2011 and GV-LPC2211 cameras running firmware V1.12 and earlier; identify network topology and assess external accessibility. Within 7 days: Implement network segmentation to isolate affected cameras on a dedicated VLAN with restrictive firewall rules limiting HTTP access to authorized administrators only; disable remote administration features; deploy intrusion detection rules for exploitation attempts. Within 30 days: Monitor GeoVision security advisories for patch releases; establish device replacement or firmware upgrade timeline; evaluate alternative vendor platforms for critical surveillance deployments.

GeoVision GV-LPC CVE-2026-57878

EUVD-2026-39634 CRITICAL

Stack-based Buffer Overflow (CWE-121)

2026-06-26 GV

GHSA-6h6x-9v89-8vrr

RCE Buffer Overflow Denial Of Service Stack Overflow Gv Lpclpc2011 2211 Geovision Inc

9.8

CVSS 3.1 · Vendor: GV

Severity by source

Vendor (GV) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network request to the default web server with no user interaction (AV:N/AC:L/PR:N/UI:N); potential code execution justifies high C/I/A despite assured impact being DoS.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GV).

CVSS VectorVendor: GV

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 08:17 vuln.today

DescriptionCVE.org

An unauthenticated stack-based buffer overflow vulnerability exists in thttpd in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when processing web request parameters in a specific request path. A remote attacker may exploit this vulnerability by sending a crafted HTTP request with overly long input, resulting in memory corruption, denial of service, or potentially arbitrary code execution.

AnalysisAI

Remote code execution in GeoVision GV-LPC2011 and GV-LPC2211 license-plate-recognition cameras (firmware V1.12 and earlier) stems from a stack-based buffer overflow in the embedded thttpd web server, where overly long parameters in a specific request path overrun a fixed-size stack buffer. An unauthenticated remote attacker (per CVSS PR:N) can send a single crafted HTTP request to corrupt memory and cause denial of service or potentially execute arbitrary code on the device. No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and lack of authentication make this a high-priority embedded-device exposure.

Technical ContextAI

The affected component is thttpd (tiny/turbo/throttling HTTP daemon), a lightweight single-process web server commonly embedded in IP cameras and IoT appliances to serve their management interface. The root cause is CWE-121 (Stack-based Buffer Overflow): the request handler copies attacker-controlled parameter data from a specific request path into a fixed-size stack buffer without validating its length, allowing the copy to overwrite the saved return address and adjacent stack data. The CPE 'cpe:2.3:a:geovision_inc.:gv-lpclpc2011/2211' identifies the affected products as GeoVision's GV-LPC2011 and GV-LPC2211 license-plate-recognition (LPR) camera units running firmware V1.12 or earlier. Embedded targets like these frequently run without modern stack protections (stack canaries, ASLR, NX) on constrained architectures, which raises the realistic likelihood that a stack overflow is exploitable for code execution rather than only crashing the service.

RemediationAI

No specific fixed firmware version was provided in the input, so no vendor-released patch version can be cited; consult GeoVision's security page at https://www.geovision.com.tw/cyber_security.php for the patched firmware build superseding V1.12 and upgrade affected GV-LPC2011/GV-LPC2211 units to it as the primary fix. Until a confirmed patch is applied, reduce exposure by removing these cameras from direct internet reachability and restricting access to the device web/management interface (thttpd HTTP port) to a dedicated management VLAN or trusted admin hosts via firewall ACLs - the trade-off is that legitimate remote administration must then traverse a VPN or jump host. Place the cameras behind a reverse proxy or network IPS that can drop HTTP requests with abnormally long parameters on the affected request path, accepting that custom inspection rules may need tuning to avoid breaking legitimate management traffic. Avoid exposing the camera UI through port-forwarding or UPnP, and disable any remote-access features not strictly required.