What is the CVSS score of EUVD-2026-39629?

EUVD-2026-39629 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of GeoVision GV-LPC2011 are affected by EUVD-2026-39629?

GeoVision license plate cameras (GV-LPC2011/GV-LPC2211, firmware V1.12 and earlier) can be remotely disabled without authentication, disrupting both physical security surveillance and network access…

How to fix or mitigate EUVD-2026-39629?

Within 24 hours: Identify all GeoVision GV-LPC2011 and GV-LPC2211 cameras and verify firmware versions; immediately restrict network access to these devices to trusted administrative subnets. Within 7 days: Deploy network segmentation isolating cameras to a dedicated VLAN with strict egress/ingress controls; document inventory of all affected devices and assess operational criticality; disable IEEE8021x_upload functionality via device settings if not operationally required. Within 30 days: Monitor GeoVision security advisories for firmware patches (targeting release V1.13 or later); conduct risk assessment on affected camera locations and develop replacement strategy; consider temporary alternative surveillance solutions for high-availability deployments pending patch availability.

GeoVision GV-LPC2011 EUVD-2026-39629

| CVE-2026-57873 HIGH

NULL Pointer Dereference (CWE-476)

2026-06-26 GV

GHSA-8vq6-q3wm-j729

Denial Of Service Null Pointer Dereference Gv Lpclpc2011 2211 Geovision Inc

7.5

CVSS 3.1 · Vendor: GV

Severity by source

Vendor (GV) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote unauthenticated malformed request needs no privileges or interaction (AV:N/AC:L/PR:N/UI:N); a NULL deref crash impacts only availability (A:H), with no C/I impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GV).

CVSS VectorVendor: GV

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 08:15 vuln.today

DescriptionCVE.org

An unauthenticated NULL pointer dereference vulnerability exists in IEEE8021x_upload.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by improper validation of multipart upload headers when processing certificate-related upload fields. A remote attacker may exploit this vulnerability by sending a malformed multipart request, causing the affected CGI process to crash and resulting in a denial of service.

AnalysisAI

Denial of service in GeoVision GV-LPC2011 and GV-LPC2211 license plate cameras (firmware V1.12 and earlier) lets remote unauthenticated attackers crash the IEEE8021x_upload.cgi process by sending a malformed multipart upload request, triggering a NULL pointer dereference (CWE-476). The high availability impact (CVSS 7.5, A:H) means the device's 802.1x certificate-upload functionality - and potentially the management interface - becomes unavailable until the process or device restarts. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The affected components are GeoVision GV-LPC2011 and GV-LPC2211, which are GeoVision's License Plate Capture (LPC/LPR) network cameras used in ANPR and access-control deployments (CPE: cpe:2.3:a:geovision_inc.:gv-lpclpc2011/2211). The flaw lives in IEEE8021x_upload.cgi, a CGI endpoint that handles uploads of certificates used for IEEE 802.1x port-based network access authentication. The root cause is CWE-476 (NULL Pointer Dereference): when parsing multipart/form-data upload headers for certificate-related fields, the CGI fails to validate that expected header fields/values are present, so a missing or malformed field yields a NULL pointer that is later dereferenced, crashing the process. This is a memory-safety/input-validation defect in the multipart parsing logic rather than a logic or auth flaw.

RemediationAI

Consult GeoVision's security advisory at https://www.geovision.com.tw/cyber_security.php and upgrade affected GV-LPC2011/GV-LPC2211 devices to a firmware release newer than V1.12 once published; the input data does not specify an exact fixed firmware version, so treat the patched build as 'patch available per vendor advisory' and confirm the version directly with GeoVision before deploying. Because exploitation targets a network-reachable CGI, the most effective compensating control until patching is network exposure reduction: do not expose these cameras directly to the internet, place them on an isolated/management VLAN, and restrict access to the web/management interface (and the IEEE8021x_upload.cgi endpoint) to trusted admin hosts via firewall ACLs - the trade-off is that legitimate remote certificate management must then originate from those allowlisted hosts. Where 802.1x certificate upload is not actively used, restricting or proxying access to that endpoint limits the attack surface with minimal operational impact.