GeoVision GV-LPC2011 EUVD-2026-39629

Exploitation requires only network reachability to the device's web service and the ability to send an HTTP POST to the IEEE8021x_upload.cgi endpoint; the specific trigger is a malformed multipart/form-data request with missing or invalid headers in the certificate-related upload fields. Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no non-default configuration are needed against affected firmware (V1.12 and earlier). The main limiting factors are deployment-based rather than technical: the attacker must be able to reach the camera's management interface, so devices behind firewalls, on isolated VLANs, or not exposed to untrusted networks are substantially harder to reach, and the impact is limited to a denial of service (availability only).

Signals are largely consistent and point to a genuine but bounded DoS risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = 7.5 High) indicates trivial remote, unauthenticated, no-interaction exploitation, but impact is confined to availability - no confidentiality or integrity loss and no code execution from this NULL dereference. No EPSS score, no SSVC decision, no KEV listing, and no POC were provided, so exploitation probability cannot be quantified from the input; the absence of these does not rule out exploitation but suggests no observed mass exploitation. The practical priority is moderate: exploitation is easy and the affected devices are network-facing, but the consequence is a crash/reboot rather than compromise. Real-world severity hinges on exposure - internet-reachable cameras warrant prompt action, while segmented internal deployments face lower risk. Note one gap to verify with the vendor: it is unclear whether a crash of this single CGI degrades only certificate uploads or destabilizes the broader device.

An attacker with network reachability to an exposed GV-LPC2011/2211 camera sends a crafted malformed multipart/form-data POST to IEEE8021x_upload.cgi omitting or corrupting an expected certificate-field header, causing a NULL pointer dereference that crashes the CGI process. Repeating the request keeps the certificate-upload/management function unavailable. No authentication, user interaction, or complex setup is required (AV:N/AC:L/PR:N/UI:N), though no public POC is currently identified.