EUVD-2026-75319
GHSA-rgp5-mc48-xhxx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed PTZ service on network
-
DeliveryConnect without credentials
-
ExploitQuery PTZ state and enumerate service
-
ExecutionIssue PTZ or raw serial commands
-
ImpactActuate camera/attached serial hardware
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network reachability to the GV-LPC2211's exposed PTZ control service on firmware V1.13 - no authentication, no user interaction, and no special client configuration (AV:N/AC:L/PR:N/UI:N). The one hard prerequisite is a network path to that service port; the realistic limiting factor is deployment topology - if the camera sits on an isolated/management-only segment unreachable from the attacker, the flaw cannot be triggered remotely. Impact severity beyond PTZ control also depends on what serial-connected hardware (gate/barrier/mount controllers) is wired to the unit's serial interface. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H, 9.4) is internally consistent with the description: remote, low-complexity, no privileges, no user interaction, with high integrity/availability impact from arbitrary command issuance and only low confidentiality from PTZ readback. There is no EPSS score, KEV listing, or POC provided, so despite the near-critical score the evidence points to opportunistic/targeted rather than mass-automated exploitation at present - no public exploit identified at time of analysis. The offsetting factor is exposure: these are embedded appliances often placed on flat operational networks or, in poorly segmented deployments, reachable from wider networks, so real risk hinges on whether the PTZ service port is network-exposed. This is a genuine priority for anyone running these cameras exposed beyond a trusted segment, but blast radius is limited to the device and its attached serial hardware (S:U, no scope change). |
| Exploit ScenarioDerived | An attacker with network reachability to a GV-LPC2211 connects to the unauthenticated PTZ control service, enumerates PTZ state, then issues PTZ movement commands to point the LPR camera away from a lane and sends raw serial commands to actuate an attached barrier or gate controller. No credentials, user interaction, or exploit chaining is required; no public POC is currently identified, but the interaction is simple enough to script by hand. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 10, 2026
Unauthenticated remote control of GeoVision GV-LPC2211 license-plate-capture cameras (firmware V1.13) is possible because the PTZ control service is exposed on the network with no authentication (CWE-306). Any remote client that can reach the service can query PTZ state and, more critically, issue PTZ movement or raw serial commands to the device and its attached serial peripherals. CVSS is 9.4 and no public exploit has been identified at time of analysis, but the trivial network-reachable, unauthenticated nature makes exploitation straightforward.
RemediationAI
No vendor-released patch version is identified at time of analysis - the only reference is GeoVision's general cyber-security page (https://www.geovision.com.tw/cyber_security.php), which should be monitored for a firmware update superseding V1.13. As compensating controls, restrict network access to the PTZ control service to a dedicated management VLAN and block its port at the perimeter and inter-VLAN firewall so it is unreachable from untrusted networks (trade-off: legitimate remote PTZ/integration tooling must be moved onto that segment or reached via VPN); place the cameras behind a jump host or VPN for any remote administration; and disable or physically disconnect unused serial pass-through wiring to limit what raw serial commands can actuate (trade-off: loses any dependent serial peripheral automation). Verify segmentation with an external port scan of the camera to confirm the service is no longer reachable.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The GV-LPC2211 (and the related GV-LPC2011) is a GeoVision license-plate-recognition capture camera used in automated number-plate/parking/access deployments. The vulnerable component is a network-listening PTZ (pan-tilt-zoom) control service that also brokers raw serial commands to the camera's serial interface. The root cause is CWE-306 (Missing Authentication for a Critical Function): the service performs privileged control actions without verifying the caller's identity. Because 'raw serial commands' are passed through, the service effectively becomes an unauthenticated bridge to whatever serial-connected hardware the unit controls (motorized mounts, gates, barriers, or auxiliary controllers), which is why integrity and availability impacts are rated high while direct data confidentiality (PTZ state readback) is only low. The affected build is identified in CPE as cpe:2.3:a:geovision_inc.:gv-lpc2011/lpc2211:*:*:*:*:*:*:*:* and EUVD pins the affected version to GV-LPC2011/LPC2211 1.13.
Know when Geovision gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Remote, unauthenticated, low-complexity access to a control service (AV:N/AC:L/PR:N/UI:N); PTZ readback gives only C:L while arbitrary PTZ/raw-serial commands give I:H/A:H on the same device (S:U).
Primary rating from Vendor (GV).
CVSS VectorVendor: GV
DescriptionCVE.org
GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication, allowing remote clients to retrieve PTZ information and issue PTZ or raw serial commands.
Executive ViewAI
GeoVision GV-LPC2211 license-plate-capture cameras (firmware V1.13) are remotely controllable by any network-connected actor without authentication, exposing traffic surveillance systems to manipulation, redirection, or shutdown. Organizations operating these cameras-including law enforcement, tolling, and traffic management systems-face immediate risk of surveillance system compromise if devices are accessible from untrusted networks.
Network segmentation: move GeoVision cameras to isolated, authenticated VLANs with firewall-mediated access from admin-only systems. Access controls: disable remote PTZ management if operationally feasible; restrict PTZ API access to authenticated, IP-whitelisted administrators. Monitoring: log all PTZ state changes and serial commands; alert on out-of-hours or unexpected movement patterns. Note: These mitigations reduce attack surface but do not eliminate unauthenticated access if PTZ service binds to internal network interfaces.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Certain EOL GeoVision devices have an OS Command Injection vulnerability. Rated critical severity (CVSS 9.8), this vulne
Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Rated critical severity
A vulnerability of remote credential disclosure was discovered in Advan VD-1 firmware versions up to 230. Rated critical
A relative path traversal vulnerability found in Advan VD-1 firmware versions up to 230. Rated high severity (CVSS 7.5),
A XSS found in Advan VD-1 firmware versions up to 230. Rated medium severity (CVSS 6.1), this vulnerability is remotely
An issue was discovered in GeoVision GV-Edge Recording Manager 2.2.3.0 for windows, which contains improper permissions
GV Edge Recording Manager (ERM) v2.3.1 improperly executes application components with SYSTEM-level privileges, allowing
In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application. Rated critical
Buffer overflow exists in Geovision Door Access Control device family, an unauthenticated remote attacker can execute ar
Authenticated ONVIF command injection in GeoVision GV-LPC2211 V1.13 allows a low-privileged network attacker to execute
GeoVision GV-ASmanager's GeoWebServer.exe web service is vulnerable to a stack-based buffer overflow that allows remote,
GV-Eye V3.6.0 transmits a sensitive key as a URL parameter over unencrypted HTTP, so the key travels across the network
Exploit-DB