EUVD-2026-75303
GHSA-j82v-fwvg-qgj4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Guest-level credentials required (PR:L); camera management interface is network-accessible; impact is availability-only with no data exposure or modification possible.
Primary rating from Vendor (GV).
CVSS VectorVendor: GV
Lifecycle Timeline
2DescriptionCVE.org
GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated.
AnalysisAI
Guest-authenticated users on GeoVision GV-LPC2211 and GV-LPC2011 firmware V1.13 can invoke the SSVR firmware-upgrade mode without holding the authorization required for that privileged function (CWE-862), immediately dropping live camera services before any firmware image is submitted or validated. The affected devices are IP-based license plate recognition cameras used in physical security, traffic monitoring, and municipal surveillance deployments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Guest-level account on the target GeoVision GV-LPC2211 or GV-LPC2011 device running firmware V1.13, as confirmed by the CVSS PR:L metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) correctly reflects that this is a bounded, availability-only flaw requiring low-privilege credentials, not an unauthenticated or scope-changing vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the GeoVision security advisory at https://www.geovision.com.tw/cyber_security.php and apply any available firmware update - the exact fixed firmware version is not confirmed from the provided data and must be obtained directly from the vendor. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Gv Lpc2011 Lpc2211
View allPrivilege escalation in GeoVision LPC2011/LPC2211 1.10 web interface allows authenticated remote attackers to execute pr
Unauthenticated remote control of GeoVision GV-LPC2211 license-plate-capture cameras (firmware V1.13) is possible becaus
Privilege escalation on the GeoVision GV-LPC2211 license plate capture camera (firmware V1.13) allows an authenticated G
Authenticated OS command injection in the DdnsSetting.cgi handler of GeoVision GV-LPC2011/LPC2211 license plate capture
Stack-based buffer overflow in GeoVision GV-LPC2011/LPC2211 firmware V1.14 (260903) exposes the VLSVR service to unauthe
Stack buffer overflow in GeoVision GV-LPC2211/LPC2011 V1.13 allows a remote unauthenticated attacker to crash the ONVIF
Remote, unauthenticated resource exhaustion in GeoVision GV-LPC2211 and GV-LPC2011 firmware V1.14 (build 20260903) allow
PTZ connection starvation in GeoVision GV-LPC2011/GV-LPC2211 firmware V1.13 allows an unauthenticated remote attacker to
Authentication bypass in GeoVision LPC2011/LPC2211 license plate camera firmware version 1.10 allows remote unauthentica
Reflected cross-site scripting in GeoVision LPC2011/LPC2211 Web Interface enables remote attackers to execute arbitrary
Reflected cross-site scripting in GeoVision LPC2011/LPC2211 1.10 web interface (ssi.cgi) allows remote unauthenticated a
OS command injection in GeoVision GV-LPC2011/LPC2211 firmware V1.13 allows an authenticated administrator to achieve roo
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today