GeoVision GV-LPC2011 CVE-2026-57881

Exploitation requires network reachability to the vlsvr remote login service on a GeoVision GV-LPC2011 or GV-LPC2211 running firmware V1.12 or earlier; the attacker sends crafted login data with an over-length field to trigger the overflow. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there is no authentication requirement and no user interaction - exploitation works against default configurations as long as the login service is reachable. The principal limiting factor is therefore network exposure: devices segmented onto an isolated management network or behind a firewall blocking the login port are not remotely reachable. Reliable arbitrary code execution (as opposed to a crash/DoS) is an additional, non-guaranteed condition dependent on the device's memory layout and exploit mitigations.

The signals align toward genuine priority: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N (score 9.8) describes pre-authentication, low-complexity, network-reachable exploitation with high confidentiality, integrity, and availability impact, which for an exposed login service is a worst-case profile. Counterbalancing factors are that no EPSS score was provided, the CVE is NOT in CISA KEV (no confirmed active exploitation), and no public exploit code was supplied - so there is no evidence of in-the-wild abuse yet. The description itself is appropriately hedged on code execution (‘potentially arbitrary code execution’), meaning reliable RCE versus a reliable crash/DoS is not confirmed; on many embedded targets a buffer overflow yields a dependable DoS even when full RCE requires defeating exploit mitigations. Net: treat as high-priority for any device whose management/login port is reachable from untrusted networks, while noting the real-world exposure depends heavily on whether these LPR cameras are internet-facing or segmented.

An attacker who can reach the camera's vlsvr login port over the network connects and submits a login request containing an abnormally long input field, overflowing the fixed-size stack buffer. The corruption crashes the service (denial of service) or, with a crafted payload that controls the overwritten return address, redirects execution to attacker-supplied code on the device. No credentials or user interaction are required, and no public proof-of-concept is currently available.