GeoVision GV-LPC EUVD-2026-39633

Exploitation requires only network reachability to the vlsvr service's login endpoint on a GV-LPC2011 or GV-LPC2211 running firmware V1.12 or earlier - per CVSS PR:N/UI:N it is unauthenticated and needs no user interaction, so any attacker who can reach the login port can send the crafted format-string payload. The principal limiting factor is exposure: the device must be network-accessible to the attacker (internet-facing or same network segment), and only the affected models/firmware are vulnerable. There is no special non-default configuration requirement called out in the description; the login path is a core, always-available function.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, fully unauthenticated attack against the login path, which is a genuinely high-priority profile for an internet- or LAN-exposed camera. Impact is rated C:L/I:L/A:H - availability is the dominant, most dependable result (DoS via crash), while confidentiality/integrity are partial, consistent with probabilistic format-string memory reads/writes rather than guaranteed full compromise. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active exploitation or weaponization yet; the risk is therefore driven by ease of access and product exposure rather than confirmed in-the-wild activity. Note a mild tension: format-string bugs can sometimes escalate to code execution, but the vendor/CVSS data only claims info disclosure, corruption, and DoS, so RCE should be treated as unconfirmed.

An attacker with network access to a GV-LPC camera's login service submits login data containing format specifiers (e.g., %x%x%n) instead of valid credentials. Because the input is fed directly into a log-formatting call, the device leaks memory back to the attacker or crashes the vlsvr service, taking the camera offline. No authentication or user interaction is required, and no public POC has been identified.