GeoVision GV-LPC2211 CVE-2026-88268

Exploitation requires a valid, low-privilege user account on the GeoVision GV-LPC2211 running firmware V1.13, confirmed by both the description ('valid user') and the CVSS PR:L metric. The attacker must have network reachability to the SSVR service port on the target device. No unauthenticated exploitation path is described or implied. The vulnerability is constrained to a service crash (DoS) of the SSVR component - no remote code execution or data exfiltration has been demonstrated, limiting the impact to disruption of the license plate capture function rather than device compromise.

The CVSS 6.5 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is well-calibrated: the vulnerability is network-reachable without special conditions, but requires a valid user credential (PR:L) and produces only an availability impact. No EPSS data was provided, but the authentication barrier and DoS-only scope suggest limited opportunistic exploitation interest compared to unauthenticated RCE classes. The vulnerability is not in the CISA KEV catalog and no public PoC has been disclosed. The practical threat is targeted: an insider or attacker with stolen credentials could blind the license plate capture function during a physical security incident - even a mid-sized municipal IT team in mielec operating a parking or traffic enforcement system should weigh whether their SSVR service is network-segmented and whether camera credentials are properly controlled. Overall, this is a moderate, real-but-bounded operational risk rather than a critical infrastructure threat.

An attacker who has obtained valid low-privilege credentials to the GV-LPC2211 - through credential theft, default password reuse, or insider access - connects to the SSVR service over the network and sends a sequence of crafted fragmented SSVR messages. The malformed fragment triggers a stack overflow in the reassembly logic, crashing the SSVR service and disabling license plate recognition on the targeted camera. This could be used as a reconnaissance suppression step ahead of a physical intrusion.