What is the CVSS score of EUVD-2026-39636?

EUVD-2026-39636 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of GeoVision GV-LPC are affected by EUVD-2026-39636?

GeoVision GV-LPC2011 and GV-LPC2211 license plate camera devices (firmware V1.12 and earlier) contain a critical vulnerability that allows unauthenticated remote attackers to crash cameras or execute…

How to fix or mitigate EUVD-2026-39636?

Within 24 hours: Identify and inventory all GeoVision GV-LPC2011 and GV-LPC2211 devices running firmware V1.12 or earlier; isolate them from direct internet access using network segmentation, VLANs, or air-gapping. Within 7 days: Implement firewall rules restricting RTSP service access (port 554) to authorized networks only; deploy network-based monitoring for anomalous RTSP authentication attempts and device crashes. Within 30 days: Contact GeoVision for emergency firmware updates or end-of-life guidance; procure and deploy replacement license plate camera systems with active vendor security support.

GeoVision GV-LPC EUVD-2026-39636

| CVE-2026-57880 CRITICAL

Stack-based Buffer Overflow (CWE-121)

2026-06-26 GV

GHSA-pf4w-4444-q95v

RCE Buffer Overflow Denial Of Service Stack Overflow Gv Lpclpc2011 2211 Geovision Inc

9.8

CVSS 3.1 · Vendor: GV

Severity by source

Vendor (GV) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated remote RTSP request triggers the overflow (AV:N/AC:L/PR:N/UI:N); memory corruption enabling code execution yields full C:H/I:H/A:H on an unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GV).

CVSS VectorVendor: GV

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 08:18 vuln.today

DescriptionCVE.org

An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when parsing RTSP Digest authentication fields. A remote attacker may exploit this vulnerability by sending a crafted RTSP request containing overly long authentication data, resulting in memory corruption, denial of service, or potentially arbitrary code execution.

AnalysisAI

Unauthenticated remote code execution and denial of service in GeoVision GV-LPC2011 and GV-LPC2211 license plate camera devices (firmware V1.12 and earlier) stems from a stack-based buffer overflow in the ssvr streaming component's RTSP Digest authentication parser. A remote attacker reachable on the RTSP service can send overly long authentication field data to corrupt the stack, crashing the device or potentially executing arbitrary code with no credentials or user interaction. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 9.8 rating and unauthenticated network vector make it a high-priority patching target.

Technical ContextAI

The affected component is ssvr, the RTSP streaming server embedded in GeoVision GV-LPC2011/GV-LPC2211 automatic license-plate-recognition cameras. RTSP (Real Time Streaming Protocol, RFC 2326) supports HTTP-style Digest access authentication, where the client supplies header fields such as username, realm, nonce, response, and uri. The root cause is CWE-121 (Stack-based Buffer Overflow): the code copies attacker-controlled Digest authentication field values into a fixed-size stack buffer without validating their length, so an oversized field overruns the buffer and overwrites adjacent stack memory including saved return addresses. Per the CPE (cpe:2.3:a:geovision_inc.:gv-lpclpc2011/2211:*), this affects the application/firmware on these specific camera models rather than a general-purpose library.

RemediationAI

Upgrade affected GV-LPC2011 and GV-LPC2211 devices to firmware newer than V1.12 as published on the GeoVision security advisory page at https://www.geovision.com.tw/cyber_security.php; no exact fixed version number was provided in the source data, so verify the patched build directly with the vendor before deployment. As compensating controls until patched, restrict reachability of the RTSP service (commonly TCP port 554) to trusted management hosts via firewall or ACLs, place the cameras on an isolated VLAN with no direct internet exposure, and disable port-forwarding/UPnP rules that publish the RTSP port - the trade-off is that legitimate remote viewing/integration clients must then connect through a VPN or the restricted segment. If feasible, front the stream with a reverse proxy or VMS that terminates and validates RTSP requests, accepting added latency and configuration overhead.