GeoVision LPC2011/LPC2211 EUVD-2026-26859

Attacker must possess valid low-privilege credentials for the GeoVision LPC2011/LPC2211 web interface (PR:L). This limits exploitation to scenarios where credentials are compromised through weak/default passwords, credential reuse, phishing, or insider access. Network access to the camera's web interface TCP port (typically 80/443) is required (AV:N), meaning exploitation succeeds against internet-exposed cameras or from within the network perimeter. No special web interface features need to be enabled - the vulnerable functionality is present in default configurations running firmware version 1.10. No user interaction required (UI:N) once access is established. Limiting factors: authentication barrier prevents opportunistic scanning/exploitation; many cameras deployed on isolated surveillance VLANs reduce network reachability; organizations using centralized authentication (LDAP/RADIUS) may have stronger credential controls than local camera accounts.

Real-world risk is high for exposed devices. CVSS 9.9 accurately reflects the severity: network-accessible (AV:N), trivial to exploit once authenticated (AC:L), requires only low-privilege credentials (PR:L), and achieves full confidentiality/integrity/availability impact with scope change. The PR:L requirement is critical - attackers need valid credentials, but many IoT camera deployments use default or weak passwords, and these devices are often internet-exposed for remote access. The scope change suggests privilege escalation from web user to system-level access, potentially compromising the entire device and enabling pivoting to connected networks. However, exploitation probability is constrained by the authentication requirement - this is not a pre-auth RCE. No EPSS score provided, but the combination of network vector, low complexity, and camera deployment patterns (often DMZ/edge network placement) creates significant exposure for organizations using these devices. CISA KEV status not provided in input data. Targeted attacks against physical security infrastructure are realistic threat scenarios. Mitigation complexity is moderate: firmware patching IoT cameras requires planning and potential operational downtime for critical surveillance systems.

An attacker obtains low-privilege credentials to a GeoVision camera's web interface through password guessing, credential stuffing, or social engineering against facility management staff. They craft a malicious HTTP request targeting privileged API endpoints that lack proper authorization checks. The web interface processes the request without validating the user's privilege level, executing administrative operations such as firmware modification, configuration tampering, or system command execution. With scope change capability, the attacker escalates from web application context to underlying operating system control, potentially disabling camera recording, exfiltrating footage, or using the compromised device as a pivot point into the facility network.