What is the CVSS score of CVE-2026-88287?

CVE-2026-88287 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-88287?

Within 24 hours, inventory all GeoVision GV-LPC2211 and GV-LPC2011 cameras and confirm which devices run V1.13; immediately disable ONVIF WS-Discovery services on affected devices if that functionality is not operationally critical, or restrict discovery traffic to authorized management subnets via firewall rules. Within 7 days, deploy rate limiting on ONVIF discovery ports (typically UDP 3702) and configure logging to detect malformed Probe requests; validate that discovery restrictions do not impair camera provisioning or asset discovery workflows. Within 30 days, establish network segmentation to isolate camera management traffic from untrusted segments; monitor for vendor firmware updates and plan firmware upgrades for affected models.

GeoVision GV-LPC2211 CVE-2026-88287

EUVD-2026-75322 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-09-10 GV

GHSA-8vfh-gxj4-2pg6

Buffer Overflow Stack Overflow Gv Lpc2011 Lpc2211 Geovision Inc

7.5

CVSS 3.1 · Vendor: GV

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify camera's IP/UDP 3702 on network
Delivery

Craft WS-Discovery Probe with oversized Scopes list
Exploit

Send unauthenticated UDP packet to device
Execution

Stack buffer overflows in discovery daemon
Impact

Discovery service crashes (DoS)

Vulnerability Assessment

Weakness	CWE CWE-121 ASVS 5.0 V15 - Secure Coding and Architecture Stack buffer bounds checking MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No authentication or credentials are required. The device must be reachable over the network on UDP port 3702 (ONVIF WS-Discovery). The ONVIF WS-Discovery service must be running, which is typically the default state for IP cameras of this type to enable plug-and-play NVR integration. Exploitation is limited to availability impact (crash); confidentiality and integrity are not affected by the confirmed vulnerability. The attack is constrained to the specific firmware version V1.13 on GV-LPC2011/LPC2211 models; other GeoVision product lines are not named in available data.
Impact	CVSS 3.1 scores this at 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), which is well-calibrated: the attack is fully unauthenticated, requires no interaction, and is executable over any network path to the device's WS-Discovery port (typically UDP/3702). The sole confirmed impact is availability - specifically crashing the ONVIF discovery service. EPSS data is not provided in the input; given the niche product footprint and no KEV listing, broad automated exploitation is not a current concern. However, LPR cameras are often deployed in public or semi-public network segments with minimal segmentation, making unauthenticated network access realistic. No public exploit code has been identified at time of analysis. While CWE-121 stack overflows sometimes enable code execution, the CVSS vector's C:N/I:N limits the confirmed impact to DoS. Whether code execution is achievable is not confirmed by available data.
Exploit ScenarioDerived	An attacker with network access to the camera's WS-Discovery port (UDP/3702) crafts a WS-Discovery Probe XML message containing an abnormally large number of Scopes URI tokens and sends it to the device. The GV-LPC2211 firmware copies these tokens into a fixed-size stack buffer without checking the count, overflowing into stack control data and crashing the discovery process. The camera's ONVIF discovery service becomes unresponsive, preventing detection and management by NVR software or administrators until the service is restarted or the device is rebooted.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 10, 2026

Stack buffer overflow in GeoVision GV-LPC2211/LPC2011 V1.13 allows a remote unauthenticated attacker to crash the ONVIF WS-Discovery process by sending a crafted Probe request with an unbounded number of Scopes tokens. The device fails to enforce any limit on Scopes token count, leading to stack control-state corruption and a denial of service against the device discovery service. No public exploit code has been identified at time of analysis, but the low-complexity, unauthenticated network vector makes this straightforward to weaponize for disruption of IP camera discovery.

RemediationAI

No vendor-released patch with a specific fixed version has been identified at time of analysis. Administrators should monitor GeoVision's security advisory page at https://www.geovision.com.tw/cyber_security.php for firmware updates targeting V1.13. As an immediate compensating control, restrict network access to the device's WS-Discovery port (UDP/3702) at the network perimeter or via VLAN segmentation so that only authorized management hosts can send Probe requests - this directly eliminates the unauthenticated remote attack vector with minimal operational trade-off, since WS-Discovery is only needed during initial device provisioning. If the ONVIF discovery service can be disabled in the camera's administration interface without impacting video streaming or NVR integration, disabling it is the lowest-risk mitigation until a firmware patch is available.

Affected VersionsENISA

GV-LPC2011/LPC2211 1.13

Affected Packages

euvd gv_lpc2011_lpc2211 no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

GeoVision GV-LPC2211 and GV-LPC2011 are license plate recognition (LPR) IP cameras running firmware V1.13. The vulnerability (CWE-121: Stack-Based Buffer Overflow) resides in the device's ONVIF WS-Discovery service, a UDP-based protocol used for automatic IP camera discovery on local networks. WS-Discovery Probe messages contain a Scopes element listing URI filters; the firmware allocates a fixed stack buffer for these tokens but performs no bounds check on the token count. An attacker supplying an oversized Scopes list overflows the stack buffer, corrupting the return address or saved frame pointer and crashing the discovery daemon. CPE cpe:2.3:a:geovision_inc.:gv-lpc2011/lpc2211:*:*:*:*:*:*:*:* confirms both LPC2011 and LPC2211 models share the affected codebase.

Know when Gv Lpc2011 Lpc2211 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GV) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI 7.5 HIGH

Unauthenticated UDP probe over network (AV:N/PR:N), no complexity barrier, confirmed impact is availability-only crash with no data exposure.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GV).

CVSS VectorVendor: GV

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

DescriptionCVE.org

GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrupt stack control state and crash the discovery process.

Executive ViewAI

Why It Matters

GeoVision network cameras (GV-LPC2211/LPC2011) running firmware V1.13 contain a remotely exploitable stack buffer overflow in the ONVIF device discovery service that allows unauthenticated attackers to crash the discovery process, rendering cameras invisible to monitoring systems. Although no public exploit identified at time of analysis, the vulnerability's low complexity and network-level accessibility create significant risk of weaponization for surveillance infrastructure disruption.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Implement interim controls: disable ONVIF WS-Discovery on affected devices if operationally feasible; restrict UDP port 3702 access to trusted management subnets via firewall or network segmentation; deploy rate limiting on discovery services; monitor device health for crashes and ONVIF service restarts indicating exploitation attempts; establish a vendor contact process to obtain patched firmware when available.

Threat Intelligence Overview

EPSS Score

0.3%

Top 76% exploitable

Prevalence

Low

niche license-plate-recognition IP camera, limited enterprise footprint

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Stack-based Buffer Overflow HIGH

A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.