GeoVision GV-LPC2211 EUVD-2026-75312

Exploitation requires the attacker to first capture a valid WS-Security UsernameToken (PasswordDigest, nonce, created) from ONVIF traffic - i.e. a network position that can observe camera-to-client SOAP requests, such as a shared LAN segment, misconfigured switch, or man-in-the-middle. The enabling defect is that GV-LPC2211 V1.13 enforces neither nonce-reuse rejection nor timestamp freshness on UsernameTokens. Limiting factors: the attack is confined to whatever the ONVIF service exposes, needs the ONVIF interface reachable to the attacker, and depends on at least one legitimate authenticated ONVIF exchange occurring (or having occurred) for a token to capture; it does not require knowing or cracking the password.

The published CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) frames this as a trivially remote, unauthenticated full compromise, but that overstates ease of exploitation: an attacker must first obtain a legitimate PasswordDigest token, which in practice requires observing ONVIF traffic (passive sniffing on a shared/insecure segment or an active man-in-the-middle), so real-world attack complexity is closer to High than Low. Once a token is captured, however, replay does yield unauthenticated ONVIF control, so the high impact rating is credible. There is no EPSS figure, no POC, and no KEV entry provided, so exploitation appears theoretical/targeted rather than commodity at this time. Given that these are network-edge surveillance/LPR devices frequently reachable on flat operational networks, any operator running V1.13 should treat replayable camera authentication as a meaningful exposure and prioritize network isolation while a fix is pending.

An attacker with a foothold on the same network segment as the camera (or in a man-in-the-middle position) passively captures an ONVIF UsernameToken sent by the legitimate NVR. They then replay the captured PasswordDigest against the camera's ONVIF endpoint to authenticate their own requests, letting them pull live/recorded video, alter camera or LPR settings, or disrupt the feed. No plaintext password is ever needed and the replayed token remains valid indefinitely.