GeoVision GV-LPC EUVD-2026-39636

Exploitation requires network reachability to the RTSP/ssvr service on a GeoVision GV-LPC2011 or GV-LPC2211 running firmware V1.12 or earlier, and the attacker must send a crafted RTSP request carrying overly long Digest authentication field data - that malformed authentication header is the concrete trigger. No valid credentials are required (PR:N), no user interaction is needed (UI:N), and default configurations are exploitable since RTSP authentication parsing runs before authentication succeeds. The primary limiting factor is exposure: the attacker must have a network path to the device's RTSP listener, so cameras isolated on non-routable or firewalled segments are not remotely reachable; exploitation is also constrained to the two named models at the affected firmware level.

All available severity signals point to high real-world risk: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates fully remote, low-complexity, unauthenticated exploitation with high confidentiality, integrity, and availability impact, scored 9.8 Critical. No EPSS score, SSVC decision data, or KEV listing was provided, so probability of exploitation and automatability cannot be quantified from the input; absence of these is a data gap, not evidence of low risk. No public proof-of-concept was provided, which somewhat tempers immediate exploitation likelihood for code execution, though reliable denial of service via a buffer overflow is typically far easier to achieve than full RCE. The practical risk is bounded mainly by network exposure - these are IP cameras that may sit on segmented or NAT'd networks - but any device with its RTSP port reachable by an attacker is at serious risk.

An attacker who can reach the camera's RTSP port crafts an RTSP request (e.g., DESCRIBE or OPTIONS) containing a malformed Authorization: Digest header with an excessively long field such as username or response, and sends it without any valid credentials. The oversized value overflows the fixed stack buffer in ssvr, reliably crashing the streaming service (denial of service) and potentially overwriting the return address to execute attacker-supplied code; no public exploit was identified at time of analysis, so RCE reliability is unproven and DoS is the more certain outcome.