GeoVision GV-LPC2211 CVE-2026-88271

The attacker must have a valid Guest-level account on the GV-LPC2211 or GV-LPC2011 device, and must have network access to the SSVR service port. The SSVR service must be reachable - it is a device management service, likely accessible on the camera's management network interface. No special configuration beyond a Guest account being active is required; default Guest accounts common on surveillance devices would satisfy this prerequisite. Exploitation is limited by: (1) requiring at least Guest-level credentials (PR:L, not completely unauthenticated); (2) the niche deployment footprint of LPC cameras; and (3) the need for direct network reachability to the SSVR port (which may be blocked by network segmentation in well-managed deployments).

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields a score of 8.8 (High). The network attack vector with low complexity and only low-privilege requirements (Guest account) makes this broadly exploitable across any network segment that can reach the camera's SSVR port. The C:H/I:H/A:H impact is justified: replacing the admin password and overwriting device configuration gives the attacker full control, effectively locking out the legitimate administrator (A:H) and enabling arbitrary reconfiguration or credential exfiltration (C:H/I:H). No EPSS score, KEV listing, or public POC was provided. The vendor (GeoVision) self-reported this via their security advisory page, which is a positive signal for accuracy but means the fixed version is not independently confirmed from the available data. The scope of risk is bounded by deployment footprint - this is a niche LPC camera, not ubiquitous infrastructure - but in physical security or traffic monitoring environments, full device takeover of a license plate reader carries significant operational and privacy consequences.

An attacker with network access to the camera's SSVR port obtains or already possesses Guest-level credentials - which may be default or shared in many deployments - and sends crafted SSVR requests to overwrite the device configuration and replace the administrator password. Once the admin password is reset, the attacker gains exclusive administrative control of the camera, locking out the legitimate operator and enabling arbitrary reconfiguration (e.g., disabling recording, redirecting feeds, or pivoting to adjacent network segments). No public POC has been identified, but the straightforward authorization bypass lowers the bar for exploitation.