GeoVision GV-LPC EUVD-2026-39634

Exploitation requires network reachability to the device's thttpd web server (the HTTP management interface) and the attacker must target the specific request path whose parameter handling lacks bounds checking; the malicious input is an overly long parameter value in that request. No authentication, credentials, or user interaction are required (PR:N/UI:N), and default configurations are exploitable since the vulnerable web server is the device's standard management interface. Limiting factors: the target must be one of the GV-LPC2011 or GV-LPC2211 models running firmware V1.12 or earlier, and the attacker must be able to reach the camera's HTTP port - devices segmented behind a firewall, VPN, or non-internet-facing management network are not remotely exploitable without first gaining network access. Reliable arbitrary code execution (versus a denial-of-service crash) is conditioned on the device's memory protections; the description only rates RCE as 'potentially' achievable.

Multiple signals converge toward high priority but with notable data gaps. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes the worst realistic case: network-reachable, low-complexity, unauthenticated, no user interaction, full confidentiality/integrity/availability impact. No EPSS score, KEV listing, or SSVC decision data was provided in the input, so exploitation probability and automatability cannot be quantified from the available data - the 9.8 reflects theoretical severity, not measured in-the-wild activity. No public exploit was identified at time of analysis. The description hedges the impact as 'memory corruption, denial of service, or potentially arbitrary code execution,' so reliable RCE is not confirmed and DoS is the assured outcome; the C:H/I:H rating in the vector is somewhat aspirational relative to that 'potentially' qualifier. Net assessment: treat as a genuine priority for any organization operating these cameras (unauthenticated network-triggered crash at minimum, plausible RCE), but the absence of EPSS/KEV means urgency should be calibrated to actual exposure (internet-facing vs. segmented) rather than assuming widespread active exploitation.

An attacker scans for internet-exposed GeoVision GV-LPC cameras and sends a single crafted HTTP request containing an overly long parameter on the vulnerable request path to the thttpd server. The oversized input overflows a stack buffer, crashing the daemon (denial of service) and, on devices lacking stack protections, potentially redirecting execution to attacker-supplied code for full device compromise. No authentication or user interaction is required (AV:N/AC:L/PR:N/UI:N), making mass scanning trivial; no public proof-of-concept was identified at time of analysis.