GeoVision GV-LPC2011 EUVD-2026-39628

Exploitation requires only that the GeoVision GV-LPC2011/GV-LPC2211 web/CGI interface (specifically the get_fcont.cgi endpoint) be network-reachable from the attacker; the CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no special privileges, and no user interaction are needed against default configurations. The concrete prerequisite is reachability of the HTTP service exposing get_fcont.cgi on firmware V1.12 or earlier. The primary limiting factors are deployment-driven rather than technical: devices placed behind a firewall, VPN, or management VLAN are not exposable, and the impact is bounded to files readable by the CGI process UID (information disclosure only - no write, no code execution). Firmware newer than V1.12 removes the flaw.

All signals point in a consistent direction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, low-complexity, unauthenticated exploitation requiring no user interaction, and the C:H/I:N/A:N impact correctly scopes this to confidentiality only - there is no code execution or denial of service. No EPSS score, KEV listing, or SSVC decision data was supplied, so exploitation probability and automatability cannot be quantified from the input; this is missing rather than low. There is no public exploit identified at time of analysis, so the realistic near-term risk is moderate rather than emergency-grade. The mitigating real-world factor is footprint: this is niche LPR camera hardware, not ubiquitous infrastructure, so mass internet-wide exploitation is less likely than targeted attacks against exposed devices. The headline 7.5 is justified for any device whose management interface is internet-reachable.

An attacker scans for internet-exposed GeoVision LPR appliances and sends a crafted HTTP request to get_fcont.cgi with a traversal payload (e.g., a file-path parameter containing ../../ sequences) pointing at a sensitive file such as a password or configuration file. The CGI reads and returns the file contents without any authentication, handing the attacker credentials or configuration data that can enable deeper compromise. No public POC is currently identified, but the low attack complexity means a working request is trivial to craft.