Geovision Inc
Monthly
GeoVision GV-ASmanager's GeoWebServer.exe web service is vulnerable to a stack-based buffer overflow that allows remote, unauthenticated attackers to crash the service, causing a denial-of-service condition. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms only an availability impact; confidentiality and integrity are unaffected. No public exploit code or active exploitation has been identified at time of analysis, but any exposed GV-ASmanager web port could be disrupted.
Command injection in GeoVision GV-ASManager's GeoWebServer.exe allows unauthenticated remote attackers who can reach the default web ports to execute arbitrary OS commands with high confidentiality, integrity, and availability impact. The CVSS 3.1 score is 9.8 and the weakness class is CWE-78, but no public exploit identified at time of analysis and no CISA KEV entry is present in the supplied data. Because the management web service is typically central to access-control operations, exposed instances should be treated as high priority while the exact affected version range and vulnerable endpoint are confirmed against GeoVision's advisory.
GV-Eye V3.6.0 transmits a sensitive key as a URL parameter over unencrypted HTTP, so the key travels across the network in cleartext and can be captured by anyone positioned to observe that traffic. With AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, the impact is a high-confidence confidentiality loss with no integrity or availability effect - the assessed vector differs from the reported 7.5 score only in attack complexity (High instead of Low), because exploitation requires an on-path/man-in-the-middle vantage point rather than a directly reachable server-side trigger. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a context-limited confidentiality weakness rather than an actively exploited emergency; the EPSS-derived urgency is not elevated by any confirmed exploitation signal in the supplied data.
A hardcoded API key ships inside the GeoVision GV-Eye Android application (V3.6.0) and can be recovered by reverse engineering the publicly distributed APK, allowing anyone who extracts it to invoke whatever GeoVision backend API operations that key authorizes. The impact is confidentiality-only (C:H, I:N, A:N) scoped to a single embedded credential, and the independent assessment scores it as a local-vector issue (AV:L) because the attacker must first obtain and analyze the client package. No public exploit code identified at time of analysis, and the CVE is not listed in CISA KEV; the practical damage ceiling depends on whether GeoVision rotates or revokes the leaked key on the server side.
Hardcoded API key exposure in the GeoVision GV-Eye Android application (V3.6.0) allows unauthenticated remote attackers to extract the key from the publicly distributable APK via reverse engineering and use it to access backend or third-party services, resulting in high confidentiality impact. With a CVSS score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and CWE-798 classification, the vulnerability requires no user interaction or special privileges, though the actual blast radius is limited by the permissions associated with the single exposed key. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Local DLL search-order hijacking in the GeoVision GV-Remote E-Map Windows desktop application allows an attacker who already holds a local foothold with write access to a directory the application searches to execute arbitrary code in the security context of the GV-Remote E-Map process. The weakness is CWE-427 and is scored CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so it is not remotely exploitable and requires host-local write permission plus a normal application launch for the hijacked library to load. No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation, and the practical risk is largely determined by whether the application's install and working directories are ACL-restricted against standard users.
Remote, unauthenticated resource exhaustion in GeoVision GV-LPC2211 and GV-LPC2011 firmware V1.14 (build 20260903) allows an attacker to disable the device by abusing the VLSVR streaming protocol. By declaring arbitrarily large frame lengths and then stalling the blocking receive indefinitely, an attacker can lock up memory buffers, exhaust connection slots, and starve worker threads until the license plate recognition service becomes entirely unresponsive. No active exploitation or public proof-of-concept has been identified at time of analysis.
Stack-based buffer overflow in GeoVision GV-LPC2011/LPC2211 firmware V1.14 (260903) exposes the VLSVR service to unauthenticated remote denial-of-service attacks. Multiple VLSVR request handlers fail to validate variable-length input fields before copying them into fixed-size stack buffers, allowing a network-reachable attacker with no credentials to crash the service. No public exploit code or active exploitation has been identified at time of analysis, though the zero-authentication, low-complexity network attack surface warrants prompt attention for cameras deployed outside isolated VLANs.
Stack buffer overflow in GeoVision GV-LPC2211/LPC2011 V1.13 allows a remote unauthenticated attacker to crash the ONVIF WS-Discovery process by sending a crafted Probe request with an unbounded number of Scopes tokens. The device fails to enforce any limit on Scopes token count, leading to stack control-state corruption and a denial of service against the device discovery service. No public exploit code has been identified at time of analysis, but the low-complexity, unauthenticated network vector makes this straightforward to weaponize for disruption of IP camera discovery.
PTZ connection starvation in GeoVision GV-LPC2011/GV-LPC2211 firmware V1.13 allows an unauthenticated remote attacker to monopolize the device's PTZ accept loop by establishing and retaining a session without releasing connection state, permanently blocking all subsequent PTZ control connections until the device is rebooted. The root cause is improper connection lifecycle management (CWE-400: Uncontrolled Resource Consumption) - the firmware imposes no idle timeout, connection limit, or non-blocking safeguard on the PTZ listener. No public exploit code exists and this CVE is not listed in the CISA KEV catalog; the CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects trivially automatable, unauthenticated network exploitability.
Unauthenticated remote control of GeoVision GV-LPC2211 license-plate-capture cameras (firmware V1.13) is possible because the PTZ control service is exposed on the network with no authentication (CWE-306). Any remote client that can reach the service can query PTZ state and, more critically, issue PTZ movement or raw serial commands to the device and its attached serial peripherals. CVSS is 9.4 and no public exploit has been identified at time of analysis, but the trivial network-reachable, unauthenticated nature makes exploitation straightforward.
Root-level command injection in GeoVision GV-LPC2211 and GV-LPC2011 license plate recognition cameras (firmware V1.13) allows an authenticated administrator to execute arbitrary OS commands as root by embedding shell metacharacters in the FTP account username field. The injected payload is executed during a subsequent FTP-account update operation, yielding complete device compromise. No public exploit is identified at time of analysis, and no confirmed patched firmware version has been independently verified.
Authentication replay in GeoVision GV-LPC2211 license-plate-recognition cameras (firmware V1.13, marketed as GV-LPCLPC2011/2211) lets an attacker who captures a single WS-Security UsernameToken re-submit its PasswordDigest to authenticate arbitrary ONVIF operations. Because the device does not track UsernameToken nonces or enforce timestamp freshness, a passively observed token grants ongoing control of the camera's ONVIF interface without ever recovering the plaintext credential. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Authenticated ONVIF command injection in GeoVision GV-LPC2211 V1.13 allows a low-privileged network attacker to execute arbitrary OS commands as root via the ConsumerReference.Address parameter of the ONVIF event subscription interface. The vulnerability stems from unsanitized user-controlled input passed directly to a shell interpreter on the device. Full device compromise - including credential extraction, persistent backdoor installation, and lateral movement within the physical security network - is achievable by any valid ONVIF account. No public exploit has been identified at time of analysis, and no KEV listing is present.
OS command injection in GeoVision GV-LPC2211 firmware V1.13 allows an authenticated administrator to execute arbitrary commands with root privileges by setting a WEP key value containing embedded shell metacharacters. The root cause (CWE-78) is unsanitized passthrough of administrator-supplied WiFi configuration input into a system shell call on the embedded device OS. No public exploit code or active exploitation has been identified at time of analysis.
OS command injection in GeoVision GV-LPC2011/LPC2211 firmware V1.13 allows an authenticated administrator to achieve root-level command execution on the device by embedding shell metacharacters in the WPA-PSK (Wi-Fi pre-shared key) field of the wireless configuration. When the configuration is saved and applied, the unsanitized PSK value is passed to a shell command without escaping, executing attacker-controlled code as root. No public exploit code or active exploitation has been identified at time of analysis, but the requirement for only administrator credentials - typically held by installers or facility operators - limits but does not eliminate abuse potential.
OS command injection in GeoVision GV-LPC2011/LPC2211 firmware V1.13 allows an authenticated administrator to execute arbitrary shell commands as root by setting a crafted wireless SSID containing shell metacharacters. The device's SSID configuration field passes user-controlled input unsanitized to the underlying embedded Linux shell, yielding full root-level control over the device. No public exploit code or active exploitation has been identified at time of analysis, but root impact on a network-connected physical security device makes this a meaningful risk wherever admin credentials could be reused or stolen.
Command injection in GeoVision GV-LPC2011/LPC2211 firmware version 1.13 allows an authenticated administrator to execute arbitrary OS commands as root by injecting shell metacharacters into the PPPoE username field. The device sources the username value directly within a shell configuration assignment, enabling a breakout to arbitrary command execution. No public exploit code or CISA KEV listing has been identified at time of analysis, but full root compromise is achievable by any user with administrative access to the device's web interface.
Stored OS command injection in GeoVision GV-LPC2211 V1.13 allows an authenticated administrator to achieve arbitrary root-level code execution on the embedded device by crafting a username that contains shell metacharacters, which are unsafely interpolated into a shell command when the account is later deleted. The vulnerability affects both the GV-LPC2011 and GV-LPC2211 license plate recognition camera models per the CPE entry. No public exploit code or active KEV-listed exploitation has been identified at time of analysis.
Privilege escalation on the GeoVision GV-LPC2211 license plate capture camera (firmware V1.13) allows an authenticated Guest-level user to overwrite the device's administrative configuration and replace the administrator password via the SSVR service, resulting in full device takeover. The root cause is CWE-862 (Missing Authorization): the SSVR service does not enforce authorization boundaries between the Guest role and administrator-level configuration operations. No public exploit or CISA KEV listing has been identified at time of analysis, but the network-accessible attack surface and low privilege bar make this a meaningful risk in any deployment where Guest accounts are enabled or accessible.
GeoVision GV-ASManager's unsafe DLL search path resolution allows a local low-privileged attacker who can write to a directory searched by the application to preempt a legitimate library with a crafted DLL, executing arbitrary code under the GV-ASManager process's security privileges when the application is subsequently launched. The root cause is CWE-428 (Unquoted Search Path or Element), where Windows DLL resolution traverses attacker-controllable directories before reaching the intended library location. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the full C:H/I:H/A:H CVSS impact reflects total process compromise upon successful exploitation.
Hard-coded RSA private key exposure in GeoVision GV-AS1620 (GV-Cloud) access-control appliances lets remote attackers decrypt and forge the device's HTTPS traffic. The firmware ships an embedded, static RSA private key used by the built-in Lighttpd web server for TLS termination, so anyone who extracts it from one device can passively decrypt or actively impersonate the management interface of every device sharing that key. No public exploit identified at time of analysis, but the shared-secret nature makes the flaw broadly reusable once the key is recovered.
Hard-coded RSA private key exposure in the GeoVision GV-AS1620 (AS Manager) access-control device lets attackers who extract the firmware-embedded key decrypt and forge the Lighttpd TLS session used for the device's HTTPS management interface. Because the key is static and shared across all units of the same firmware, a single extraction compromises every deployed device, enabling passive traffic decryption and active server impersonation. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV.
Local privilege/code execution in GeoVision's GV-IP Device Utility is possible via DLL hijacking (CWE-427): the Windows desktop application loads one or more DLLs from an unsafe search path, letting a local attacker who can plant a malicious DLL run code in the context of the user who launches the utility. Exploitation requires the victim to execute the application (UI:R) and the attacker to already have a foothold with low privileges on the host (PR:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; CVSS is 7.3 (High).
Buffer overflow in GeoVision's GeoWebPlayer addon (also branded "Web Plugin" in GV-VMS and "WS Player" in VMS-Cloud) allows memory corruption and likely code execution in the local WebSocket server process. The `handle_connection_info` handler for the `connectionInfo` command copies attacker-controlled JSON strings (including the `ip` field) into fixed-size stack/heap buffers using unbounded byte-by-byte loops, so an oversized value overruns the buffer. Because the WebSocket server binds to localhost, exploitation is realistically driven by luring an authenticated user's browser to a malicious page that issues the command; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Stack buffer overflow in GeoVision's GeoWebPlayer addon (also branded "Web Plugin" for GV-VMS and "WS Player" for VMS-Cloud) lets an attacker corrupt fixed-size buffers and potentially achieve code execution against users of GV-VMS, GV-Cloud and related GeoVision products. The flaw lives in the local WebSocket server's connectionInfo command handler, which copies attacker-controlled JSON strings byte-by-byte without length checks; because a malicious web page loaded in the victim's browser can drive that local WebSocket, exploitation is scored network-reachable (CVSS 8.3) but requires user interaction and high attack complexity. No public exploit is identified at time of analysis, though the issue was reported by Cisco Talos, which typically develops proof-of-concept material.
Remote code execution in GeoVision GeoWebPlayer (the browser-facing 'Web Plugin'/'WS Player' addon bundled with GV-VMS, GV-Cloud and related products) is possible because the local WebSocket server's connectionInfo handler copies attacker-controlled JSON fields into fixed-size buffers with unchecked byte-by-byte loops. A remote attacker who lures a user to a malicious web page can drive the victim's browser to send an oversized password field to the localhost WebSocket, overflowing the buffer and achieving code execution (CVSS 8.3). There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Cross-site WebSocket-driven buffer overflow in GeoVision GeoWebPlayer (the 'Web Plugin'/'WS Player' addon bundled with GV-VMS, GV-Cloud and VMS-Cloud) lets an attacker reach the localhost WebSocket server and overflow fixed-size buffers via the `connectionInfo` command's username field, achieving memory corruption and likely code execution (CVSS 8.3, CWE-120). Because the server listens on localhost, exploitation is reached through a victim's browser visiting a malicious page (UI:R, AC:H), giving high confidentiality, integrity and availability impact with a scope change. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the flaw was independently documented by Cisco Talos (TALOS-2026-2375).
Buffer overflow vulnerabilities in GeoVision's GeoWebPlayer WebSocket addon (CWE-120) allow a remote attacker to induce code execution by luring a user running the addon into visiting a malicious webpage that sends a crafted `connectionInfo` WebSocket command with an oversized password field to the locally-listening service. The unbounded manual byte-by-byte copy in `handle_connection_info` overwrites adjacent memory, potentially yielding full process compromise across all impact dimensions (C:H/I:H/A:H). Reported by Cisco Talos (TALOS-2026-2375) and acknowledged by GeoVision; no public exploit code or CISA KEV listing identified at time of analysis.
Remote code execution in GeoVision GeoWebPlayer (the "Web Plugin"/"WS Player" addon bundled with GV-VMS, GV-Cloud and VMS-Cloud) is possible because the addon's localhost WebSocket server processes a 'connectionInfo' command whose handler copies attacker-supplied JSON strings into fixed-size buffers without bounds checks (CWE-120). Because the WebSocket is reachable via the victim's browser (AV:N), a malicious web page can drive the overflow when a user with the addon installed visits it (UI:R), yielding memory corruption with high confidentiality, integrity and availability impact and a scope change. No public exploit identified at time of analysis, though Cisco Talos has published a detailed report (TALOS-2026-2375); no EPSS or CISA KEV data was provided.
Out-of-bounds array access in GeoVision's GeoWebPlayer add-on (also branded 'Web Plugin' for GV-VMS and 'WS Player' for VMS-Cloud) lets an attacker abuse the 'byPass' WebSocket command by supplying an unchecked 'index' value, corrupting memory to achieve high-impact compromise (CVSS 8.3). The bundled component runs a local WebSocket server for GeoVision web interfaces (GV-VMS, GV-Cloud); because the server is reachable from a victim's browser, a malicious web page can drive the flaw with only user interaction and no authentication. No public exploit identified at time of analysis, though a Talos vulnerability report (TALOS-2026-2373) documents the issue.
Out-of-bounds array indexing in GeoVision's GeoWebPlayer addon (also branded 'Web Plugin' in GV-VMS and 'WS Player' in VMS-Cloud) allows a remote attacker to leak memory or crash the local WebSocket service by delivering a malformed 'pause' command. The addon runs a WebSocket server that backs the browser interfaces of GeoVision products such as GV-VMS and GV-Cloud, so any browser tricked into connecting to it can trigger the flaw. No public exploit identified at time of analysis; the issue was reported by the vendor (GeoVision) and documented by Cisco Talos (TALOS-2026-2373).
Out-of-bounds array access in GeoVision GeoWebPlayer (a.k.a. "Web Plugin"/"WS Player"), a websocket-server addon bundled with GV-VMS, GV-Cloud and related GeoVision software, lets an attacker who lures a victim to a malicious web page reach the localhost websocket and supply an unvalidated `index` to leak memory and corrupt state (CWE-129). The play command in particular accepts an attacker-controlled index used to index internal arrays without a range check, enabling information disclosure and potential code-path corruption. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the vendor has published a security advisory and Talos has released a detailed report.
Out-of-bounds array access in GeoVision's GeoWebPlayer (a.k.a. 'Web Plugin' / 'WS Player') addon lets an attacker read memory, corrupt state, or crash the local WebSocket helper bundled with GV-VMS, GV-Cloud, and related surveillance software. The plugin's localhost WebSocket server processes commands (such as 'disconnect') that carry an attacker-controlled 'index' used to dereference internal arrays without bounds checking (CWE-129), yielding high confidentiality, integrity, and availability impact. The CVSS 3.1 vector (AV:N/UI:R/S:C) reflects a cross-origin browser-driven vector where a victim lured to a malicious page has their browser relay commands to the local WebSocket; there is no public exploit identified at time of analysis and no CISA KEV listing.
Out-of-bounds array access in GeoVision's GeoWebPlayer addon (also branded 'Web Plugin' in GV-VMS and 'WS Player' in VMS-Cloud) can lead to remote code execution when the addon's localhost WebSocket server processes a saveVideo command with an attacker-controlled index. Because the addon ships with widely-used GeoVision products (GV-VMS, GV-Cloud) and is reachable from a victim's browser via a malicious web page, a lured user visiting attacker-controlled content can trigger an out-of-bounds function-pointer call. This is a Talos-reported (TALOS-2026-2373) issue with no public exploit identified at time of analysis and is not listed in CISA KEV.
Out-of-bounds array access in GeoVision's GeoWebPlayer (the 'Web Plugin'/'WS Player' addon bundled with GV-VMS, GV-Cloud and related software) lets an attacker abuse the local WebSocket server's snapshot command by supplying an unchecked 'index' value that indexes arrays beyond their bounds. Because the CVSS vector is AV:N/UI:R with a scope change, a victim who visits a malicious web page can have their browser drive the localhost WebSocket into out-of-bounds reads/writes, yielding information disclosure and potential memory corruption (C:H/I:H/A:H). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Out-of-bounds array access in GeoVision's GeoWebPlayer addon (also branded 'Web Plugin' in GV-VMS and 'WS Player' for VMS-Cloud) lets an attacker corrupt memory or leak sensitive data by sending a 2wayAudio WebSocket command with an unchecked index value. The addon runs a localhost WebSocket server that expands GeoVision web interfaces, and its command handlers use caller-supplied index values to index internal arrays without validating their range. Reported by GeoVision and Talos (TALOS-2026-2373); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Memory-disclosure and denial-of-service in GeoVision's GeoWebPlayer (also branded 'Web Plugin' in GV-VMS and 'WS Player' in VMS-Cloud) stems from an unvalidated `index` parameter in its localhost WebSocket command handler (audio command path), letting an attacker read and act on out-of-bounds array elements. Because the WebSocket listener is reachable cross-origin, a victim who is lured to a malicious web page can have their browser drive the local service, so the effective attack vector is network-based despite the server binding to localhost. No public exploit code is identified at time of analysis, though a Cisco Talos advisory (TALOS-2026-2373) documents the flaw; it is not listed in CISA KEV.
Out-of-bounds array access in GeoVision's GeoWebPlayer (also branded 'Web Plugin' in GV-VMS and 'WS Player' in VMS-Cloud) lets an attacker corrupt or read process memory by sending crafted WebSocket commands to the localhost server the addon exposes. The specific 'setPIP' command accepts an attacker-controlled 'index' that is used to index internal arrays without range validation, yielding information disclosure and potential memory corruption. There is no public exploit identified at time of analysis, though a Cisco Talos technical report (TALOS-2026-2373) documents the flaw; it is not listed in CISA KEV and no EPSS score is provided.
Out-of-bounds array access in GeoVision's GeoWebPlayer (also branded 'Web Plugin' in GV-VMS and 'WS Player' in VMS-Cloud) lets an attacker abuse the addon's localhost WebSocket server via a crafted 'setStream' command whose attacker-controlled 'index' is used to index arrays without range validation (CWE-129), enabling memory disclosure and possible corruption. Because a victim's browser can be steered into connecting to the local WebSocket service, the vendor rates this AV:N/UI:R (CVSS 8.3) - a remote web page can pivot to the local service after the user visits it. No public exploit is identified at time of analysis and it is not in CISA KEV, so this is not confirmed as actively exploited.
Out-of-bounds array access in GeoVision GeoWebPlayer (the "Web Plugin"/"WS Player" addon bundled with GV-VMS, GV-Cloud and related software) lets a remote attacker corrupt memory via the local WebSocket server's connectInfo command. Because the server trusts an attacker-supplied index without range validation, a victim lured to a malicious web page can trigger high-impact confidentiality, integrity and availability effects (CVSS 8.3, scope-changed). No public exploit identified at time of analysis; the flaw was reported by the vendor (GV) and documented by Cisco Talos.
Missing authentication in GeoVision's GeoWebPlayer addon (also branded 'Web Plugin' in GV-VMS and 'WS Player' in VMS-Cloud) lets any web page reach a locally-bound, unauthenticated WebSocket server and invoke sensitive APIs. By chaining the `create` method with `getScreenCapture`, a remote attacker who lures a victim to a malicious site can silently exfiltrate the contents of the user's screen. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list; CVSS is 8.8 driven by network reach and a scope change into the browsing user's data.
Remote unauthenticated stack-based buffer overflow in the vlsvr login service of GeoVision GV-LPC2011 and GV-LPC2211 license plate capture cameras (firmware V1.12 and earlier) lets a remote attacker corrupt memory by sending an over-length login field, enabling denial of service and potentially arbitrary code execution. The flaw requires no authentication and no user interaction (CVSS 9.8). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote code execution and denial of service in GeoVision GV-LPC2011 and GV-LPC2211 license plate camera devices (firmware V1.12 and earlier) stems from a stack-based buffer overflow in the ssvr streaming component's RTSP Digest authentication parser. A remote attacker reachable on the RTSP service can send overly long authentication field data to corrupt the stack, crashing the device or potentially executing arbitrary code with no credentials or user interaction. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 9.8 rating and unauthenticated network vector make it a high-priority patching target.
Remote code execution and denial of service in GeoVision GV-LPC2011 and GV-LPC2211 license-plate-recognition cameras (V1.12 and earlier) arise from a stack-based buffer overflow in the ssvr component's RTSP custom authentication handling. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates an unauthenticated remote attacker can trigger memory corruption with a single crafted RTSP request, yielding crash-level DoS and potential arbitrary code execution. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Remote code execution in GeoVision GV-LPC2011 and GV-LPC2211 license-plate-recognition cameras (firmware V1.12 and earlier) stems from a stack-based buffer overflow in the embedded thttpd web server, where overly long parameters in a specific request path overrun a fixed-size stack buffer. An unauthenticated remote attacker (per CVSS PR:N) can send a single crafted HTTP request to corrupt memory and cause denial of service or potentially execute arbitrary code on the device. No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and lack of authentication make this a high-priority embedded-device exposure.
Unauthenticated format string flaw in the vlsvr service of GeoVision GV-LPC2011 and GV-LPC2211 license plate recognition cameras (firmware V1.12 and earlier) lets remote attackers send crafted login data that the device passes unsanitized into a log-formatting routine. Successful exploitation can leak memory contents, corrupt memory, or crash the service, with the high availability impact (CVSS 8.6) reflecting denial of service as the most reliable outcome. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Denial of service in GeoVision GV-LPC2011 and GV-LPC2211 license plate recognition cameras (firmware V1.12 and earlier) lets remote, unauthenticated attackers crash the device by sending a crafted HTTP request to onvif.cgi. The ONVIF CGI handler fails to bounds-check HTTP request body data, so oversized input triggers an out-of-bounds write and memory corruption. No public exploit identified at time of analysis, and the flaw yields availability impact only — no code execution or data disclosure is claimed by the vendor.
Denial of service in GeoVision GV-LPC2011 and GV-LPC2211 license-plate capture devices (firmware V1.12 and earlier) lets a remote, unauthenticated attacker crash the device by sending a single malformed HTTP request to its CGI interface. The flaw is a NULL pointer dereference in HTTP request-parsing logic shared across multiple CGI components, triggered when required request metadata is missing or malformed. No public exploit identified at time of analysis, and the issue has no confidentiality or integrity impact - only availability.
Denial of service in GeoVision GV-LPC2011 and GV-LPC2211 license-plate-capture devices (firmware V1.12 and earlier) allows remote unauthenticated attackers to crash the device by sending a multipart upload request with an overly long filename to IEEE8021x_upload.cgi. The flaw is a classic stack/heap buffer overflow (CWE-120) with availability-only impact and no confidentiality or integrity loss. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Denial of service in GeoVision GV-LPC2011 and GV-LPC2211 license plate cameras (firmware V1.12 and earlier) lets remote unauthenticated attackers crash the IEEE8021x_upload.cgi process by sending a malformed multipart upload request, triggering a NULL pointer dereference (CWE-476). The high availability impact (CVSS 7.5, A:H) means the device's 802.1x certificate-upload functionality - and potentially the management interface - becomes unavailable until the process or device restarts. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.
Arbitrary file read in GeoVision GV-LPC2011 and GV-LPC2211 license plate recognition appliances (firmware V1.12 and earlier) lets a remote, unauthenticated attacker traverse the filesystem via the get_fcont.cgi endpoint and retrieve any file readable by the CGI process. Because the CGI fails to validate the user-supplied file path, a single crafted HTTP request can disclose configuration files, credentials, or other sensitive data. There is no public exploit identified at time of analysis, but the network-reachable, no-authentication nature (CVSS 7.5) makes it straightforward to weaponize.
Remote OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows attackers with high privileges to execute arbitrary shell commands by sending crafted network packets to the DVRSearch service or Network.cgi endpoint. The flaw lives in libNetSetObj.so where DNS configuration values are concatenated into a shell command string and passed to system() without sanitization. No public exploit identified at time of analysis, but the vendor advisory and a Talos vulnerability report are published.
OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows authenticated remote attackers to execute arbitrary shell commands via unsanitized gateway address input passed to system() inside libNetSetObj.so. The flaw is reachable through both the network-exposed DVRSearch service and the Network.cgi endpoint, granting full device compromise. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows attackers who can reach the device's network services to execute arbitrary shell commands via unsanitised netmask input passed to system() inside libNetSetObj.so. The flawed CNetSetObj::m_F_n_Set_Net_Mask routine is reachable through both the network-exposed DVRSearch service and the Network.cgi endpoint, yielding code execution in the context of the configuration daemon. No public exploit identified at time of analysis, but the Talos report provides full reverse-engineered detail that materially lowers the barrier to weaponisation.
OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows remote attackers with high privileges to execute arbitrary shell commands by sending crafted network packets to the libNetSetObj.so library via the DVRSearch service or Network.cgi endpoint. The flaw stems from unsanitized attacker-controlled IP address input passed directly to system() in CNetSetObj::m_F_n_Set_IP_Addr. No public exploit identified at time of analysis, though Talos Intelligence disclosed the issue with technical detail (TALOS-2026-2379).
Remote unauthenticated stack-based buffer overflow in GeoVision GV-I/O Box 4E smart I/O appliances allows any host on the same network to corrupt memory in the DVRSearch service (UDP/10001) by sending a crafted message that triggers an unbounded memcpy of the device's configured DNS address into a fixed-size stack buffer. The flaw is rated CVSS 10.0 with scope change and full CIA impact, and no public exploit has been identified at time of analysis. Successful exploitation can fully compromise the embedded controller used for relay/I/O automation.
Stack-based buffer overflow in the GeoVision GV-I/O Box 4E DVRSearch service allows unauthenticated network attackers to corrupt memory by sending a crafted UDP datagram to port 10001. The flaw stems from an unchecked memcpy of the device's configured gateway field into a fixed-offset reply buffer, enabling code execution on the embedded device with no public exploit identified at time of analysis.
Stack-based buffer overflow in GeoVision GV-I/O Box 4E allows unauthenticated remote attackers to overflow a fixed-size stack buffer by sending a crafted UDP packet to the DVRSearch service on port 10001. The flaw, tracked as CWE-121 with a maximum CVSS 10.0 score and scope change, can be triggered by any host able to reach the device on the network, with no public exploit identified at time of analysis.
Stack-based buffer overflow in GeoVision GV-I/O Box 4E embedded I/O controllers allows unauthenticated network attackers to corrupt memory via the DVRSearch service on UDP port 10001. The vulnerable code path uses memcpy with an attacker-influenced length derived from a stored IP address into a fixed-size stack buffer, yielding potential remote code execution at CVSS 10.0 with scope change. No public exploit identified at time of analysis, though Talos has published a vulnerability report (TALOS-2026-2377).
Remote code execution in GeoVision GV-ASWeb 6.2.0 allows authenticated users with System Setting permissions to execute arbitrary commands by bypassing frontend restrictions through crafted HTTP POST requests to the ASWebCommon.srf backend endpoint. This authenticated network-accessible vulnerability achieves full system compromise (confidentiality, integrity, and availability impact) with low attack complexity. No public exploit code or active exploitation confirmed at time of analysis, though EPSS data unavailable for risk contextualization.
Remote code execution in GeoVision GV-VMS V20 (version 20.0.2) allows unauthenticated attackers to corrupt stack memory via a crafted HTTP request to the WebCam Server Login functionality, leading to arbitrary code execution on the video management system. The flaw is a CWE-787 out-of-bounds write (stack buffer overflow) carrying a CVSS 9.8 score, and no public exploit identified at time of analysis, though Talos has published a vulnerability report (TALOS-2026-2369). EPSS is currently low at 0.12%, but the unauthenticated network attack surface on a video surveillance product makes this a high-priority patching target.
Remote code execution in GeoVision GV-VMS V20 20.0.2 allows unauthenticated attackers to execute arbitrary code as SYSTEM via stack overflow in WebCam Server Login functionality. A specially crafted HTTP request with oversized username or password fields (exceeding 40 characters) triggers unconstrained sscanf buffer handling. CVSS 9.0 with high attack complexity reflects exploitation constraints (no null bytes allowed in payload), though network vector and lack of authentication requirements present significant risk. No active exploitation confirmed (not in CISA KEV); EPSS data unavailable for final risk assessment.
Remote unauthenticated code execution in GeoVision GV-VMS V20 WebCam Server allows attackers to execute arbitrary code as SYSTEM via stack buffer overflow. The `gvapi` endpoint bypasses standard authentication and copies base64-decoded HTTP Authorization headers into a 256-byte stack buffer without bounds checking, enabling full stack control. The WebCam Server binary is compiled without ASLR, significantly lowering exploitation complexity. CVSS 10.0 with network vector, no prerequisites, and changed scope reflecting system-level compromise. Publicly disclosed by Cisco Talos and vendor advisory available from GeoVision.
Privilege escalation in GeoVision LPC2011/LPC2211 1.10 web interface allows authenticated remote attackers to execute privileged operations via crafted HTTP requests. The vulnerability enables scope change (S:C) indicating potential escape from restricted web interface contexts to underlying system privileges. CVSS 9.9 (Critical) with low attack complexity and no user interaction required, making this exploitable by any authenticated user through simple web requests. No public exploit identified at time of analysis.
Authentication bypass in GeoVision LPC2011/LPC2211 license plate camera firmware version 1.10 allows remote unauthenticated attackers to brute-force predictable session cookies via the Web Interface and gain access to the device. The flaw stems from insufficient randomness in session token generation (CWE-341), enabling attackers to enumerate valid cookies through a crafted series of HTTP requests. No public exploit identified at time of analysis, and EPSS is low at 0.06%, but CISA SSVC rates technical impact as partial with no current exploitation observed.
Authenticated OS command injection in the DdnsSetting.cgi handler of GeoVision GV-LPC2011/LPC2211 license plate capture cameras (firmware 1.10) lets an attacker with low-privilege access to the device web interface execute arbitrary OS commands by writing a crafted value into the DDNS configuration. CVSS scores the issue 8.8 (high) with full confidentiality, integrity, and availability impact, and Talos has published an advisory (TALOS-2025-2326); no public exploit identified at time of analysis and EPSS is low at 0.17%.
Credential interception in GeoVision GV-IP Device Utility 9.0.5 allows network attackers to decrypt administrator passwords from broadcast UDP packets. The application broadcasts device commands with credentials encrypted using a modified Blowfish scheme, but includes the decryption key in the same packet - reducing security to algorithm obscurity. Attackers on the same LAN can capture these broadcasts when legitimate administrators interact with GeoVision IP cameras or devices, decrypt credentials using reverse-engineered algorithms, then gain full device control to reconfigure or factory-reset equipment. EPSS and KEV data not available; CVSS 9.3 reflects network-accessible credential disclosure requiring user interaction.
Credential disclosure in GeoVision GV-IP Device Utility 9.0.5 allows network attackers to intercept administrator passwords via broadcast UDP traffic containing symmetric encryption keys. When administrators issue privileged commands to GeoVision IP devices, the utility broadcasts credentials encrypted with a Blowfish-derived algorithm but includes the decryption key in the same packet, enabling passive network eavesdropping to extract full device credentials. CVSS 9.3 (Critical) with scope change reflects the pivot risk from utility compromise to full device control, including IP reconfiguration and factory resets.
Arbitrary file read in GeoVision GV-LPC2211 v1.13 allows authenticated remote users to exfiltrate any file accessible to the root-run web service by supplying unsanitized absolute path parameters to BKDownloadLink.cgi. The CGI handler fails entirely to restrict the filename input, making the vulnerability straightforward to exploit by any valid credential holder. No public exploit or active exploitation has been identified, and no patched firmware version is confirmed in available sources.
Stack-based buffer overflow in GeoVision GV-LPC2211 firmware V1.13 allows an authenticated administrator to crash the ONVIF worker process by submitting a SetUser SOAP request containing an excessive number of User XML elements, overwriting stack control state. Impact is limited to denial of service of the camera's ONVIF management interface, with no confidentiality or integrity compromise confirmed. No public exploit code or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in the GeoVision GV-LPC2011/LPC2211 V1.13 ONVIF CreateUsers handler allows an authenticated administrator to crash the ONVIF worker process by submitting a crafted SOAP request containing repeated User XML elements. The vulnerability overwrites stack control state, resulting in a denial-of-service condition limited to the ONVIF subsystem. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS vector (PR:H, A:H only) constrains real-world impact to availability loss by credentialed administrators.
Stack-based buffer overflow in the GeoVision GV-LPC2211 V1.13 ONVIF service allows an authenticated administrator to crash the ONVIF worker by submitting a DeleteUsers SOAP request containing an unbounded number of Username elements. The overflow exhausts the stack array allocated for the username list, terminating the ONVIF worker process. Impact is limited to availability - the CVSS vector confirms no confidentiality or integrity compromise (C:N/I:N/A:H). No public exploit code or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in the ONVIF SetUser password handler of GeoVision GV-LPC2211 firmware V1.13 allows an authenticated administrator to crash the ONVIF worker process by supplying an excessively long password string. The sole confirmed impact is availability loss to the ONVIF service - no confidentiality or integrity impact is present per the CVSS vector (C:N/I:N/A:H). No public exploit code or active exploitation has been identified at time of analysis.
Authenticated administrator-triggered stack buffer overflow in the GeoVision GV-LPC2211/LPC2011 V1.13 ONVIF service causes a crash of the ONVIF worker process. When an admin-authenticated user submits an oversized username or password value through the ONVIF CreateUsers operation, the device copies the value into a fixed-size stack buffer without bounds checking, resulting in a denial-of-service condition limited to the ONVIF subsystem. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Guest-authenticated users on GeoVision GV-LPC2211 and GV-LPC2011 firmware V1.13 can invoke the SSVR firmware-upgrade mode without holding the authorization required for that privileged function (CWE-862), immediately dropping live camera services before any firmware image is submitted or validated. The affected devices are IP-based license plate recognition cameras used in physical security, traffic monitoring, and municipal surveillance deployments. No public exploit code has been identified at time of analysis, but the network-accessible attack vector with only low-privilege credentials required makes the disruption trivially easy for any user holding a Guest account.
Plaintext credential disclosure in GeoVision GV-LPC2211 V1.13 allows an authenticated Guest-level user to retrieve the full persistent device configuration - including administrative and standard user passwords in cleartext - via the SSVR service endpoint. The root cause is a missing authorization check (CWE-862): the device fails to restrict configuration retrieval to privileged roles, allowing the Guest role to access sensitive data it should never reach. While direct CVSS impact is confidentiality-only, exposure of admin credentials enables full device takeover as a secondary step, elevating practical risk for physical-security deployments. No public exploit has been identified at time of analysis.
Stack buffer overflow in GeoVision GV-LPC2211 firmware V1.13 allows any authenticated, low-privilege user to remotely crash the SSVR service by sending crafted fragmented SSVR protocol data. Both the GV-LPC2011 and GV-LPC2211 models share the affected codebase per CPE data. Impact is limited to availability loss - no code execution or data disclosure has been demonstrated, and no public exploit code has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in the GV-Cloud component of GeoVision GV-VMS V20 20.0.2 enables a remote attacker with a network-intercept position to crash the video management system, causing high-impact denial of service against physical security infrastructure. Exploitation requires impersonating the legitimate GV-Cloud server - achieved via MitM techniques - and delivering a specially crafted network payload that corrupts stack memory in the GV-Cloud client handler. Reported by Cisco Talos (TALOS-2026-2411); no public exploit has been identified at time of analysis and no CISA KEV listing exists.
Privilege escalation in GeoVision LPC2011/LPC2211 Web Interface allows authenticated attackers to leak stored credentials via specially crafted HTTP requests to the ssi.cgi endpoint. The vulnerability affects firmware version 1.10 and requires low-privilege user access but no additional user interaction, enabling unauthenticated credential disclosure on affected devices.
Reflected cross-site scripting in GeoVision LPC2011/LPC2211 Web Interface enables remote attackers to execute arbitrary JavaScript in victim browsers via crafted URLs targeting the ssi.cgi error handler. The vulnerability chains through social engineering (requires user interaction) but achieves high confidentiality impact through changed scope (S:C), allowing session hijacking and credential theft from authenticated administrators. EPSS data not provided; no CISA KEV listing indicates this is not yet confirmed as actively exploited in the wild. Publicly available exploit code status unknown but detailed technical disclosure exists from Cisco Talos Intelligence.
Reflected cross-site scripting in GeoVision LPC2011/LPC2211 1.10 web interface (ssi.cgi) allows remote unauthenticated attackers to execute arbitrary JavaScript in victim browsers via crafted URLs. The vulnerability achieves scope change (S:C in CVSS), enabling access to high-confidentiality data across security contexts despite requiring user interaction. No public exploit code or CISA KEV listing identified at time of analysis, though vendor advisory confirms the flaw. EPSS data not available. The RCE tag appears to be a mislabeling - this is strictly client-side JavaScript execution (XSS), not server-side remote code execution.
GeoVision GV-ASmanager's GeoWebServer.exe web service is vulnerable to a stack-based buffer overflow that allows remote, unauthenticated attackers to crash the service, causing a denial-of-service condition. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms only an availability impact; confidentiality and integrity are unaffected. No public exploit code or active exploitation has been identified at time of analysis, but any exposed GV-ASmanager web port could be disrupted.
Command injection in GeoVision GV-ASManager's GeoWebServer.exe allows unauthenticated remote attackers who can reach the default web ports to execute arbitrary OS commands with high confidentiality, integrity, and availability impact. The CVSS 3.1 score is 9.8 and the weakness class is CWE-78, but no public exploit identified at time of analysis and no CISA KEV entry is present in the supplied data. Because the management web service is typically central to access-control operations, exposed instances should be treated as high priority while the exact affected version range and vulnerable endpoint are confirmed against GeoVision's advisory.
GV-Eye V3.6.0 transmits a sensitive key as a URL parameter over unencrypted HTTP, so the key travels across the network in cleartext and can be captured by anyone positioned to observe that traffic. With AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, the impact is a high-confidence confidentiality loss with no integrity or availability effect - the assessed vector differs from the reported 7.5 score only in attack complexity (High instead of Low), because exploitation requires an on-path/man-in-the-middle vantage point rather than a directly reachable server-side trigger. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a context-limited confidentiality weakness rather than an actively exploited emergency; the EPSS-derived urgency is not elevated by any confirmed exploitation signal in the supplied data.
A hardcoded API key ships inside the GeoVision GV-Eye Android application (V3.6.0) and can be recovered by reverse engineering the publicly distributed APK, allowing anyone who extracts it to invoke whatever GeoVision backend API operations that key authorizes. The impact is confidentiality-only (C:H, I:N, A:N) scoped to a single embedded credential, and the independent assessment scores it as a local-vector issue (AV:L) because the attacker must first obtain and analyze the client package. No public exploit code identified at time of analysis, and the CVE is not listed in CISA KEV; the practical damage ceiling depends on whether GeoVision rotates or revokes the leaked key on the server side.
Hardcoded API key exposure in the GeoVision GV-Eye Android application (V3.6.0) allows unauthenticated remote attackers to extract the key from the publicly distributable APK via reverse engineering and use it to access backend or third-party services, resulting in high confidentiality impact. With a CVSS score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and CWE-798 classification, the vulnerability requires no user interaction or special privileges, though the actual blast radius is limited by the permissions associated with the single exposed key. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Local DLL search-order hijacking in the GeoVision GV-Remote E-Map Windows desktop application allows an attacker who already holds a local foothold with write access to a directory the application searches to execute arbitrary code in the security context of the GV-Remote E-Map process. The weakness is CWE-427 and is scored CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so it is not remotely exploitable and requires host-local write permission plus a normal application launch for the hijacked library to load. No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation, and the practical risk is largely determined by whether the application's install and working directories are ACL-restricted against standard users.
Remote, unauthenticated resource exhaustion in GeoVision GV-LPC2211 and GV-LPC2011 firmware V1.14 (build 20260903) allows an attacker to disable the device by abusing the VLSVR streaming protocol. By declaring arbitrarily large frame lengths and then stalling the blocking receive indefinitely, an attacker can lock up memory buffers, exhaust connection slots, and starve worker threads until the license plate recognition service becomes entirely unresponsive. No active exploitation or public proof-of-concept has been identified at time of analysis.
Stack-based buffer overflow in GeoVision GV-LPC2011/LPC2211 firmware V1.14 (260903) exposes the VLSVR service to unauthenticated remote denial-of-service attacks. Multiple VLSVR request handlers fail to validate variable-length input fields before copying them into fixed-size stack buffers, allowing a network-reachable attacker with no credentials to crash the service. No public exploit code or active exploitation has been identified at time of analysis, though the zero-authentication, low-complexity network attack surface warrants prompt attention for cameras deployed outside isolated VLANs.
Stack buffer overflow in GeoVision GV-LPC2211/LPC2011 V1.13 allows a remote unauthenticated attacker to crash the ONVIF WS-Discovery process by sending a crafted Probe request with an unbounded number of Scopes tokens. The device fails to enforce any limit on Scopes token count, leading to stack control-state corruption and a denial of service against the device discovery service. No public exploit code has been identified at time of analysis, but the low-complexity, unauthenticated network vector makes this straightforward to weaponize for disruption of IP camera discovery.
PTZ connection starvation in GeoVision GV-LPC2011/GV-LPC2211 firmware V1.13 allows an unauthenticated remote attacker to monopolize the device's PTZ accept loop by establishing and retaining a session without releasing connection state, permanently blocking all subsequent PTZ control connections until the device is rebooted. The root cause is improper connection lifecycle management (CWE-400: Uncontrolled Resource Consumption) - the firmware imposes no idle timeout, connection limit, or non-blocking safeguard on the PTZ listener. No public exploit code exists and this CVE is not listed in the CISA KEV catalog; the CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects trivially automatable, unauthenticated network exploitability.
Unauthenticated remote control of GeoVision GV-LPC2211 license-plate-capture cameras (firmware V1.13) is possible because the PTZ control service is exposed on the network with no authentication (CWE-306). Any remote client that can reach the service can query PTZ state and, more critically, issue PTZ movement or raw serial commands to the device and its attached serial peripherals. CVSS is 9.4 and no public exploit has been identified at time of analysis, but the trivial network-reachable, unauthenticated nature makes exploitation straightforward.
Root-level command injection in GeoVision GV-LPC2211 and GV-LPC2011 license plate recognition cameras (firmware V1.13) allows an authenticated administrator to execute arbitrary OS commands as root by embedding shell metacharacters in the FTP account username field. The injected payload is executed during a subsequent FTP-account update operation, yielding complete device compromise. No public exploit is identified at time of analysis, and no confirmed patched firmware version has been independently verified.
Authentication replay in GeoVision GV-LPC2211 license-plate-recognition cameras (firmware V1.13, marketed as GV-LPCLPC2011/2211) lets an attacker who captures a single WS-Security UsernameToken re-submit its PasswordDigest to authenticate arbitrary ONVIF operations. Because the device does not track UsernameToken nonces or enforce timestamp freshness, a passively observed token grants ongoing control of the camera's ONVIF interface without ever recovering the plaintext credential. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Authenticated ONVIF command injection in GeoVision GV-LPC2211 V1.13 allows a low-privileged network attacker to execute arbitrary OS commands as root via the ConsumerReference.Address parameter of the ONVIF event subscription interface. The vulnerability stems from unsanitized user-controlled input passed directly to a shell interpreter on the device. Full device compromise - including credential extraction, persistent backdoor installation, and lateral movement within the physical security network - is achievable by any valid ONVIF account. No public exploit has been identified at time of analysis, and no KEV listing is present.
OS command injection in GeoVision GV-LPC2211 firmware V1.13 allows an authenticated administrator to execute arbitrary commands with root privileges by setting a WEP key value containing embedded shell metacharacters. The root cause (CWE-78) is unsanitized passthrough of administrator-supplied WiFi configuration input into a system shell call on the embedded device OS. No public exploit code or active exploitation has been identified at time of analysis.
OS command injection in GeoVision GV-LPC2011/LPC2211 firmware V1.13 allows an authenticated administrator to achieve root-level command execution on the device by embedding shell metacharacters in the WPA-PSK (Wi-Fi pre-shared key) field of the wireless configuration. When the configuration is saved and applied, the unsanitized PSK value is passed to a shell command without escaping, executing attacker-controlled code as root. No public exploit code or active exploitation has been identified at time of analysis, but the requirement for only administrator credentials - typically held by installers or facility operators - limits but does not eliminate abuse potential.
OS command injection in GeoVision GV-LPC2011/LPC2211 firmware V1.13 allows an authenticated administrator to execute arbitrary shell commands as root by setting a crafted wireless SSID containing shell metacharacters. The device's SSID configuration field passes user-controlled input unsanitized to the underlying embedded Linux shell, yielding full root-level control over the device. No public exploit code or active exploitation has been identified at time of analysis, but root impact on a network-connected physical security device makes this a meaningful risk wherever admin credentials could be reused or stolen.
Command injection in GeoVision GV-LPC2011/LPC2211 firmware version 1.13 allows an authenticated administrator to execute arbitrary OS commands as root by injecting shell metacharacters into the PPPoE username field. The device sources the username value directly within a shell configuration assignment, enabling a breakout to arbitrary command execution. No public exploit code or CISA KEV listing has been identified at time of analysis, but full root compromise is achievable by any user with administrative access to the device's web interface.
Stored OS command injection in GeoVision GV-LPC2211 V1.13 allows an authenticated administrator to achieve arbitrary root-level code execution on the embedded device by crafting a username that contains shell metacharacters, which are unsafely interpolated into a shell command when the account is later deleted. The vulnerability affects both the GV-LPC2011 and GV-LPC2211 license plate recognition camera models per the CPE entry. No public exploit code or active KEV-listed exploitation has been identified at time of analysis.
Privilege escalation on the GeoVision GV-LPC2211 license plate capture camera (firmware V1.13) allows an authenticated Guest-level user to overwrite the device's administrative configuration and replace the administrator password via the SSVR service, resulting in full device takeover. The root cause is CWE-862 (Missing Authorization): the SSVR service does not enforce authorization boundaries between the Guest role and administrator-level configuration operations. No public exploit or CISA KEV listing has been identified at time of analysis, but the network-accessible attack surface and low privilege bar make this a meaningful risk in any deployment where Guest accounts are enabled or accessible.
GeoVision GV-ASManager's unsafe DLL search path resolution allows a local low-privileged attacker who can write to a directory searched by the application to preempt a legitimate library with a crafted DLL, executing arbitrary code under the GV-ASManager process's security privileges when the application is subsequently launched. The root cause is CWE-428 (Unquoted Search Path or Element), where Windows DLL resolution traverses attacker-controllable directories before reaching the intended library location. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the full C:H/I:H/A:H CVSS impact reflects total process compromise upon successful exploitation.
Hard-coded RSA private key exposure in GeoVision GV-AS1620 (GV-Cloud) access-control appliances lets remote attackers decrypt and forge the device's HTTPS traffic. The firmware ships an embedded, static RSA private key used by the built-in Lighttpd web server for TLS termination, so anyone who extracts it from one device can passively decrypt or actively impersonate the management interface of every device sharing that key. No public exploit identified at time of analysis, but the shared-secret nature makes the flaw broadly reusable once the key is recovered.
Hard-coded RSA private key exposure in the GeoVision GV-AS1620 (AS Manager) access-control device lets attackers who extract the firmware-embedded key decrypt and forge the Lighttpd TLS session used for the device's HTTPS management interface. Because the key is static and shared across all units of the same firmware, a single extraction compromises every deployed device, enabling passive traffic decryption and active server impersonation. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV.
Local privilege/code execution in GeoVision's GV-IP Device Utility is possible via DLL hijacking (CWE-427): the Windows desktop application loads one or more DLLs from an unsafe search path, letting a local attacker who can plant a malicious DLL run code in the context of the user who launches the utility. Exploitation requires the victim to execute the application (UI:R) and the attacker to already have a foothold with low privileges on the host (PR:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; CVSS is 7.3 (High).
Buffer overflow in GeoVision's GeoWebPlayer addon (also branded "Web Plugin" in GV-VMS and "WS Player" in VMS-Cloud) allows memory corruption and likely code execution in the local WebSocket server process. The `handle_connection_info` handler for the `connectionInfo` command copies attacker-controlled JSON strings (including the `ip` field) into fixed-size stack/heap buffers using unbounded byte-by-byte loops, so an oversized value overruns the buffer. Because the WebSocket server binds to localhost, exploitation is realistically driven by luring an authenticated user's browser to a malicious page that issues the command; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Stack buffer overflow in GeoVision's GeoWebPlayer addon (also branded "Web Plugin" for GV-VMS and "WS Player" for VMS-Cloud) lets an attacker corrupt fixed-size buffers and potentially achieve code execution against users of GV-VMS, GV-Cloud and related GeoVision products. The flaw lives in the local WebSocket server's connectionInfo command handler, which copies attacker-controlled JSON strings byte-by-byte without length checks; because a malicious web page loaded in the victim's browser can drive that local WebSocket, exploitation is scored network-reachable (CVSS 8.3) but requires user interaction and high attack complexity. No public exploit is identified at time of analysis, though the issue was reported by Cisco Talos, which typically develops proof-of-concept material.
Remote code execution in GeoVision GeoWebPlayer (the browser-facing 'Web Plugin'/'WS Player' addon bundled with GV-VMS, GV-Cloud and related products) is possible because the local WebSocket server's connectionInfo handler copies attacker-controlled JSON fields into fixed-size buffers with unchecked byte-by-byte loops. A remote attacker who lures a user to a malicious web page can drive the victim's browser to send an oversized password field to the localhost WebSocket, overflowing the buffer and achieving code execution (CVSS 8.3). There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Cross-site WebSocket-driven buffer overflow in GeoVision GeoWebPlayer (the 'Web Plugin'/'WS Player' addon bundled with GV-VMS, GV-Cloud and VMS-Cloud) lets an attacker reach the localhost WebSocket server and overflow fixed-size buffers via the `connectionInfo` command's username field, achieving memory corruption and likely code execution (CVSS 8.3, CWE-120). Because the server listens on localhost, exploitation is reached through a victim's browser visiting a malicious page (UI:R, AC:H), giving high confidentiality, integrity and availability impact with a scope change. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the flaw was independently documented by Cisco Talos (TALOS-2026-2375).
Buffer overflow vulnerabilities in GeoVision's GeoWebPlayer WebSocket addon (CWE-120) allow a remote attacker to induce code execution by luring a user running the addon into visiting a malicious webpage that sends a crafted `connectionInfo` WebSocket command with an oversized password field to the locally-listening service. The unbounded manual byte-by-byte copy in `handle_connection_info` overwrites adjacent memory, potentially yielding full process compromise across all impact dimensions (C:H/I:H/A:H). Reported by Cisco Talos (TALOS-2026-2375) and acknowledged by GeoVision; no public exploit code or CISA KEV listing identified at time of analysis.
Remote code execution in GeoVision GeoWebPlayer (the "Web Plugin"/"WS Player" addon bundled with GV-VMS, GV-Cloud and VMS-Cloud) is possible because the addon's localhost WebSocket server processes a 'connectionInfo' command whose handler copies attacker-supplied JSON strings into fixed-size buffers without bounds checks (CWE-120). Because the WebSocket is reachable via the victim's browser (AV:N), a malicious web page can drive the overflow when a user with the addon installed visits it (UI:R), yielding memory corruption with high confidentiality, integrity and availability impact and a scope change. No public exploit identified at time of analysis, though Cisco Talos has published a detailed report (TALOS-2026-2375); no EPSS or CISA KEV data was provided.
Out-of-bounds array access in GeoVision's GeoWebPlayer add-on (also branded 'Web Plugin' for GV-VMS and 'WS Player' for VMS-Cloud) lets an attacker abuse the 'byPass' WebSocket command by supplying an unchecked 'index' value, corrupting memory to achieve high-impact compromise (CVSS 8.3). The bundled component runs a local WebSocket server for GeoVision web interfaces (GV-VMS, GV-Cloud); because the server is reachable from a victim's browser, a malicious web page can drive the flaw with only user interaction and no authentication. No public exploit identified at time of analysis, though a Talos vulnerability report (TALOS-2026-2373) documents the issue.
Out-of-bounds array indexing in GeoVision's GeoWebPlayer addon (also branded 'Web Plugin' in GV-VMS and 'WS Player' in VMS-Cloud) allows a remote attacker to leak memory or crash the local WebSocket service by delivering a malformed 'pause' command. The addon runs a WebSocket server that backs the browser interfaces of GeoVision products such as GV-VMS and GV-Cloud, so any browser tricked into connecting to it can trigger the flaw. No public exploit identified at time of analysis; the issue was reported by the vendor (GeoVision) and documented by Cisco Talos (TALOS-2026-2373).
Out-of-bounds array access in GeoVision GeoWebPlayer (a.k.a. "Web Plugin"/"WS Player"), a websocket-server addon bundled with GV-VMS, GV-Cloud and related GeoVision software, lets an attacker who lures a victim to a malicious web page reach the localhost websocket and supply an unvalidated `index` to leak memory and corrupt state (CWE-129). The play command in particular accepts an attacker-controlled index used to index internal arrays without a range check, enabling information disclosure and potential code-path corruption. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the vendor has published a security advisory and Talos has released a detailed report.
Out-of-bounds array access in GeoVision's GeoWebPlayer (a.k.a. 'Web Plugin' / 'WS Player') addon lets an attacker read memory, corrupt state, or crash the local WebSocket helper bundled with GV-VMS, GV-Cloud, and related surveillance software. The plugin's localhost WebSocket server processes commands (such as 'disconnect') that carry an attacker-controlled 'index' used to dereference internal arrays without bounds checking (CWE-129), yielding high confidentiality, integrity, and availability impact. The CVSS 3.1 vector (AV:N/UI:R/S:C) reflects a cross-origin browser-driven vector where a victim lured to a malicious page has their browser relay commands to the local WebSocket; there is no public exploit identified at time of analysis and no CISA KEV listing.
Out-of-bounds array access in GeoVision's GeoWebPlayer addon (also branded 'Web Plugin' in GV-VMS and 'WS Player' in VMS-Cloud) can lead to remote code execution when the addon's localhost WebSocket server processes a saveVideo command with an attacker-controlled index. Because the addon ships with widely-used GeoVision products (GV-VMS, GV-Cloud) and is reachable from a victim's browser via a malicious web page, a lured user visiting attacker-controlled content can trigger an out-of-bounds function-pointer call. This is a Talos-reported (TALOS-2026-2373) issue with no public exploit identified at time of analysis and is not listed in CISA KEV.
Out-of-bounds array access in GeoVision's GeoWebPlayer (the 'Web Plugin'/'WS Player' addon bundled with GV-VMS, GV-Cloud and related software) lets an attacker abuse the local WebSocket server's snapshot command by supplying an unchecked 'index' value that indexes arrays beyond their bounds. Because the CVSS vector is AV:N/UI:R with a scope change, a victim who visits a malicious web page can have their browser drive the localhost WebSocket into out-of-bounds reads/writes, yielding information disclosure and potential memory corruption (C:H/I:H/A:H). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Out-of-bounds array access in GeoVision's GeoWebPlayer addon (also branded 'Web Plugin' in GV-VMS and 'WS Player' for VMS-Cloud) lets an attacker corrupt memory or leak sensitive data by sending a 2wayAudio WebSocket command with an unchecked index value. The addon runs a localhost WebSocket server that expands GeoVision web interfaces, and its command handlers use caller-supplied index values to index internal arrays without validating their range. Reported by GeoVision and Talos (TALOS-2026-2373); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Memory-disclosure and denial-of-service in GeoVision's GeoWebPlayer (also branded 'Web Plugin' in GV-VMS and 'WS Player' in VMS-Cloud) stems from an unvalidated `index` parameter in its localhost WebSocket command handler (audio command path), letting an attacker read and act on out-of-bounds array elements. Because the WebSocket listener is reachable cross-origin, a victim who is lured to a malicious web page can have their browser drive the local service, so the effective attack vector is network-based despite the server binding to localhost. No public exploit code is identified at time of analysis, though a Cisco Talos advisory (TALOS-2026-2373) documents the flaw; it is not listed in CISA KEV.
Out-of-bounds array access in GeoVision's GeoWebPlayer (also branded 'Web Plugin' in GV-VMS and 'WS Player' in VMS-Cloud) lets an attacker corrupt or read process memory by sending crafted WebSocket commands to the localhost server the addon exposes. The specific 'setPIP' command accepts an attacker-controlled 'index' that is used to index internal arrays without range validation, yielding information disclosure and potential memory corruption. There is no public exploit identified at time of analysis, though a Cisco Talos technical report (TALOS-2026-2373) documents the flaw; it is not listed in CISA KEV and no EPSS score is provided.
Out-of-bounds array access in GeoVision's GeoWebPlayer (also branded 'Web Plugin' in GV-VMS and 'WS Player' in VMS-Cloud) lets an attacker abuse the addon's localhost WebSocket server via a crafted 'setStream' command whose attacker-controlled 'index' is used to index arrays without range validation (CWE-129), enabling memory disclosure and possible corruption. Because a victim's browser can be steered into connecting to the local WebSocket service, the vendor rates this AV:N/UI:R (CVSS 8.3) - a remote web page can pivot to the local service after the user visits it. No public exploit is identified at time of analysis and it is not in CISA KEV, so this is not confirmed as actively exploited.
Out-of-bounds array access in GeoVision GeoWebPlayer (the "Web Plugin"/"WS Player" addon bundled with GV-VMS, GV-Cloud and related software) lets a remote attacker corrupt memory via the local WebSocket server's connectInfo command. Because the server trusts an attacker-supplied index without range validation, a victim lured to a malicious web page can trigger high-impact confidentiality, integrity and availability effects (CVSS 8.3, scope-changed). No public exploit identified at time of analysis; the flaw was reported by the vendor (GV) and documented by Cisco Talos.
Missing authentication in GeoVision's GeoWebPlayer addon (also branded 'Web Plugin' in GV-VMS and 'WS Player' in VMS-Cloud) lets any web page reach a locally-bound, unauthenticated WebSocket server and invoke sensitive APIs. By chaining the `create` method with `getScreenCapture`, a remote attacker who lures a victim to a malicious site can silently exfiltrate the contents of the user's screen. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list; CVSS is 8.8 driven by network reach and a scope change into the browsing user's data.
Remote unauthenticated stack-based buffer overflow in the vlsvr login service of GeoVision GV-LPC2011 and GV-LPC2211 license plate capture cameras (firmware V1.12 and earlier) lets a remote attacker corrupt memory by sending an over-length login field, enabling denial of service and potentially arbitrary code execution. The flaw requires no authentication and no user interaction (CVSS 9.8). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote code execution and denial of service in GeoVision GV-LPC2011 and GV-LPC2211 license plate camera devices (firmware V1.12 and earlier) stems from a stack-based buffer overflow in the ssvr streaming component's RTSP Digest authentication parser. A remote attacker reachable on the RTSP service can send overly long authentication field data to corrupt the stack, crashing the device or potentially executing arbitrary code with no credentials or user interaction. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 9.8 rating and unauthenticated network vector make it a high-priority patching target.
Remote code execution and denial of service in GeoVision GV-LPC2011 and GV-LPC2211 license-plate-recognition cameras (V1.12 and earlier) arise from a stack-based buffer overflow in the ssvr component's RTSP custom authentication handling. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates an unauthenticated remote attacker can trigger memory corruption with a single crafted RTSP request, yielding crash-level DoS and potential arbitrary code execution. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Remote code execution in GeoVision GV-LPC2011 and GV-LPC2211 license-plate-recognition cameras (firmware V1.12 and earlier) stems from a stack-based buffer overflow in the embedded thttpd web server, where overly long parameters in a specific request path overrun a fixed-size stack buffer. An unauthenticated remote attacker (per CVSS PR:N) can send a single crafted HTTP request to corrupt memory and cause denial of service or potentially execute arbitrary code on the device. No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and lack of authentication make this a high-priority embedded-device exposure.
Unauthenticated format string flaw in the vlsvr service of GeoVision GV-LPC2011 and GV-LPC2211 license plate recognition cameras (firmware V1.12 and earlier) lets remote attackers send crafted login data that the device passes unsanitized into a log-formatting routine. Successful exploitation can leak memory contents, corrupt memory, or crash the service, with the high availability impact (CVSS 8.6) reflecting denial of service as the most reliable outcome. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Denial of service in GeoVision GV-LPC2011 and GV-LPC2211 license plate recognition cameras (firmware V1.12 and earlier) lets remote, unauthenticated attackers crash the device by sending a crafted HTTP request to onvif.cgi. The ONVIF CGI handler fails to bounds-check HTTP request body data, so oversized input triggers an out-of-bounds write and memory corruption. No public exploit identified at time of analysis, and the flaw yields availability impact only — no code execution or data disclosure is claimed by the vendor.
Denial of service in GeoVision GV-LPC2011 and GV-LPC2211 license-plate capture devices (firmware V1.12 and earlier) lets a remote, unauthenticated attacker crash the device by sending a single malformed HTTP request to its CGI interface. The flaw is a NULL pointer dereference in HTTP request-parsing logic shared across multiple CGI components, triggered when required request metadata is missing or malformed. No public exploit identified at time of analysis, and the issue has no confidentiality or integrity impact - only availability.
Denial of service in GeoVision GV-LPC2011 and GV-LPC2211 license-plate-capture devices (firmware V1.12 and earlier) allows remote unauthenticated attackers to crash the device by sending a multipart upload request with an overly long filename to IEEE8021x_upload.cgi. The flaw is a classic stack/heap buffer overflow (CWE-120) with availability-only impact and no confidentiality or integrity loss. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Denial of service in GeoVision GV-LPC2011 and GV-LPC2211 license plate cameras (firmware V1.12 and earlier) lets remote unauthenticated attackers crash the IEEE8021x_upload.cgi process by sending a malformed multipart upload request, triggering a NULL pointer dereference (CWE-476). The high availability impact (CVSS 7.5, A:H) means the device's 802.1x certificate-upload functionality - and potentially the management interface - becomes unavailable until the process or device restarts. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.
Arbitrary file read in GeoVision GV-LPC2011 and GV-LPC2211 license plate recognition appliances (firmware V1.12 and earlier) lets a remote, unauthenticated attacker traverse the filesystem via the get_fcont.cgi endpoint and retrieve any file readable by the CGI process. Because the CGI fails to validate the user-supplied file path, a single crafted HTTP request can disclose configuration files, credentials, or other sensitive data. There is no public exploit identified at time of analysis, but the network-reachable, no-authentication nature (CVSS 7.5) makes it straightforward to weaponize.
Remote OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows attackers with high privileges to execute arbitrary shell commands by sending crafted network packets to the DVRSearch service or Network.cgi endpoint. The flaw lives in libNetSetObj.so where DNS configuration values are concatenated into a shell command string and passed to system() without sanitization. No public exploit identified at time of analysis, but the vendor advisory and a Talos vulnerability report are published.
OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows authenticated remote attackers to execute arbitrary shell commands via unsanitized gateway address input passed to system() inside libNetSetObj.so. The flaw is reachable through both the network-exposed DVRSearch service and the Network.cgi endpoint, granting full device compromise. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows attackers who can reach the device's network services to execute arbitrary shell commands via unsanitised netmask input passed to system() inside libNetSetObj.so. The flawed CNetSetObj::m_F_n_Set_Net_Mask routine is reachable through both the network-exposed DVRSearch service and the Network.cgi endpoint, yielding code execution in the context of the configuration daemon. No public exploit identified at time of analysis, but the Talos report provides full reverse-engineered detail that materially lowers the barrier to weaponisation.
OS command injection in GeoVision GV-I/O Box 4E firmware 2.09 allows remote attackers with high privileges to execute arbitrary shell commands by sending crafted network packets to the libNetSetObj.so library via the DVRSearch service or Network.cgi endpoint. The flaw stems from unsanitized attacker-controlled IP address input passed directly to system() in CNetSetObj::m_F_n_Set_IP_Addr. No public exploit identified at time of analysis, though Talos Intelligence disclosed the issue with technical detail (TALOS-2026-2379).
Remote unauthenticated stack-based buffer overflow in GeoVision GV-I/O Box 4E smart I/O appliances allows any host on the same network to corrupt memory in the DVRSearch service (UDP/10001) by sending a crafted message that triggers an unbounded memcpy of the device's configured DNS address into a fixed-size stack buffer. The flaw is rated CVSS 10.0 with scope change and full CIA impact, and no public exploit has been identified at time of analysis. Successful exploitation can fully compromise the embedded controller used for relay/I/O automation.
Stack-based buffer overflow in the GeoVision GV-I/O Box 4E DVRSearch service allows unauthenticated network attackers to corrupt memory by sending a crafted UDP datagram to port 10001. The flaw stems from an unchecked memcpy of the device's configured gateway field into a fixed-offset reply buffer, enabling code execution on the embedded device with no public exploit identified at time of analysis.
Stack-based buffer overflow in GeoVision GV-I/O Box 4E allows unauthenticated remote attackers to overflow a fixed-size stack buffer by sending a crafted UDP packet to the DVRSearch service on port 10001. The flaw, tracked as CWE-121 with a maximum CVSS 10.0 score and scope change, can be triggered by any host able to reach the device on the network, with no public exploit identified at time of analysis.
Stack-based buffer overflow in GeoVision GV-I/O Box 4E embedded I/O controllers allows unauthenticated network attackers to corrupt memory via the DVRSearch service on UDP port 10001. The vulnerable code path uses memcpy with an attacker-influenced length derived from a stored IP address into a fixed-size stack buffer, yielding potential remote code execution at CVSS 10.0 with scope change. No public exploit identified at time of analysis, though Talos has published a vulnerability report (TALOS-2026-2377).
Remote code execution in GeoVision GV-ASWeb 6.2.0 allows authenticated users with System Setting permissions to execute arbitrary commands by bypassing frontend restrictions through crafted HTTP POST requests to the ASWebCommon.srf backend endpoint. This authenticated network-accessible vulnerability achieves full system compromise (confidentiality, integrity, and availability impact) with low attack complexity. No public exploit code or active exploitation confirmed at time of analysis, though EPSS data unavailable for risk contextualization.
Remote code execution in GeoVision GV-VMS V20 (version 20.0.2) allows unauthenticated attackers to corrupt stack memory via a crafted HTTP request to the WebCam Server Login functionality, leading to arbitrary code execution on the video management system. The flaw is a CWE-787 out-of-bounds write (stack buffer overflow) carrying a CVSS 9.8 score, and no public exploit identified at time of analysis, though Talos has published a vulnerability report (TALOS-2026-2369). EPSS is currently low at 0.12%, but the unauthenticated network attack surface on a video surveillance product makes this a high-priority patching target.
Remote code execution in GeoVision GV-VMS V20 20.0.2 allows unauthenticated attackers to execute arbitrary code as SYSTEM via stack overflow in WebCam Server Login functionality. A specially crafted HTTP request with oversized username or password fields (exceeding 40 characters) triggers unconstrained sscanf buffer handling. CVSS 9.0 with high attack complexity reflects exploitation constraints (no null bytes allowed in payload), though network vector and lack of authentication requirements present significant risk. No active exploitation confirmed (not in CISA KEV); EPSS data unavailable for final risk assessment.
Remote unauthenticated code execution in GeoVision GV-VMS V20 WebCam Server allows attackers to execute arbitrary code as SYSTEM via stack buffer overflow. The `gvapi` endpoint bypasses standard authentication and copies base64-decoded HTTP Authorization headers into a 256-byte stack buffer without bounds checking, enabling full stack control. The WebCam Server binary is compiled without ASLR, significantly lowering exploitation complexity. CVSS 10.0 with network vector, no prerequisites, and changed scope reflecting system-level compromise. Publicly disclosed by Cisco Talos and vendor advisory available from GeoVision.
Privilege escalation in GeoVision LPC2011/LPC2211 1.10 web interface allows authenticated remote attackers to execute privileged operations via crafted HTTP requests. The vulnerability enables scope change (S:C) indicating potential escape from restricted web interface contexts to underlying system privileges. CVSS 9.9 (Critical) with low attack complexity and no user interaction required, making this exploitable by any authenticated user through simple web requests. No public exploit identified at time of analysis.
Authentication bypass in GeoVision LPC2011/LPC2211 license plate camera firmware version 1.10 allows remote unauthenticated attackers to brute-force predictable session cookies via the Web Interface and gain access to the device. The flaw stems from insufficient randomness in session token generation (CWE-341), enabling attackers to enumerate valid cookies through a crafted series of HTTP requests. No public exploit identified at time of analysis, and EPSS is low at 0.06%, but CISA SSVC rates technical impact as partial with no current exploitation observed.
Authenticated OS command injection in the DdnsSetting.cgi handler of GeoVision GV-LPC2011/LPC2211 license plate capture cameras (firmware 1.10) lets an attacker with low-privilege access to the device web interface execute arbitrary OS commands by writing a crafted value into the DDNS configuration. CVSS scores the issue 8.8 (high) with full confidentiality, integrity, and availability impact, and Talos has published an advisory (TALOS-2025-2326); no public exploit identified at time of analysis and EPSS is low at 0.17%.
Credential interception in GeoVision GV-IP Device Utility 9.0.5 allows network attackers to decrypt administrator passwords from broadcast UDP packets. The application broadcasts device commands with credentials encrypted using a modified Blowfish scheme, but includes the decryption key in the same packet - reducing security to algorithm obscurity. Attackers on the same LAN can capture these broadcasts when legitimate administrators interact with GeoVision IP cameras or devices, decrypt credentials using reverse-engineered algorithms, then gain full device control to reconfigure or factory-reset equipment. EPSS and KEV data not available; CVSS 9.3 reflects network-accessible credential disclosure requiring user interaction.
Credential disclosure in GeoVision GV-IP Device Utility 9.0.5 allows network attackers to intercept administrator passwords via broadcast UDP traffic containing symmetric encryption keys. When administrators issue privileged commands to GeoVision IP devices, the utility broadcasts credentials encrypted with a Blowfish-derived algorithm but includes the decryption key in the same packet, enabling passive network eavesdropping to extract full device credentials. CVSS 9.3 (Critical) with scope change reflects the pivot risk from utility compromise to full device control, including IP reconfiguration and factory resets.
Arbitrary file read in GeoVision GV-LPC2211 v1.13 allows authenticated remote users to exfiltrate any file accessible to the root-run web service by supplying unsanitized absolute path parameters to BKDownloadLink.cgi. The CGI handler fails entirely to restrict the filename input, making the vulnerability straightforward to exploit by any valid credential holder. No public exploit or active exploitation has been identified, and no patched firmware version is confirmed in available sources.
Stack-based buffer overflow in GeoVision GV-LPC2211 firmware V1.13 allows an authenticated administrator to crash the ONVIF worker process by submitting a SetUser SOAP request containing an excessive number of User XML elements, overwriting stack control state. Impact is limited to denial of service of the camera's ONVIF management interface, with no confidentiality or integrity compromise confirmed. No public exploit code or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in the GeoVision GV-LPC2011/LPC2211 V1.13 ONVIF CreateUsers handler allows an authenticated administrator to crash the ONVIF worker process by submitting a crafted SOAP request containing repeated User XML elements. The vulnerability overwrites stack control state, resulting in a denial-of-service condition limited to the ONVIF subsystem. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS vector (PR:H, A:H only) constrains real-world impact to availability loss by credentialed administrators.
Stack-based buffer overflow in the GeoVision GV-LPC2211 V1.13 ONVIF service allows an authenticated administrator to crash the ONVIF worker by submitting a DeleteUsers SOAP request containing an unbounded number of Username elements. The overflow exhausts the stack array allocated for the username list, terminating the ONVIF worker process. Impact is limited to availability - the CVSS vector confirms no confidentiality or integrity compromise (C:N/I:N/A:H). No public exploit code or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in the ONVIF SetUser password handler of GeoVision GV-LPC2211 firmware V1.13 allows an authenticated administrator to crash the ONVIF worker process by supplying an excessively long password string. The sole confirmed impact is availability loss to the ONVIF service - no confidentiality or integrity impact is present per the CVSS vector (C:N/I:N/A:H). No public exploit code or active exploitation has been identified at time of analysis.
Authenticated administrator-triggered stack buffer overflow in the GeoVision GV-LPC2211/LPC2011 V1.13 ONVIF service causes a crash of the ONVIF worker process. When an admin-authenticated user submits an oversized username or password value through the ONVIF CreateUsers operation, the device copies the value into a fixed-size stack buffer without bounds checking, resulting in a denial-of-service condition limited to the ONVIF subsystem. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Guest-authenticated users on GeoVision GV-LPC2211 and GV-LPC2011 firmware V1.13 can invoke the SSVR firmware-upgrade mode without holding the authorization required for that privileged function (CWE-862), immediately dropping live camera services before any firmware image is submitted or validated. The affected devices are IP-based license plate recognition cameras used in physical security, traffic monitoring, and municipal surveillance deployments. No public exploit code has been identified at time of analysis, but the network-accessible attack vector with only low-privilege credentials required makes the disruption trivially easy for any user holding a Guest account.
Plaintext credential disclosure in GeoVision GV-LPC2211 V1.13 allows an authenticated Guest-level user to retrieve the full persistent device configuration - including administrative and standard user passwords in cleartext - via the SSVR service endpoint. The root cause is a missing authorization check (CWE-862): the device fails to restrict configuration retrieval to privileged roles, allowing the Guest role to access sensitive data it should never reach. While direct CVSS impact is confidentiality-only, exposure of admin credentials enables full device takeover as a secondary step, elevating practical risk for physical-security deployments. No public exploit has been identified at time of analysis.
Stack buffer overflow in GeoVision GV-LPC2211 firmware V1.13 allows any authenticated, low-privilege user to remotely crash the SSVR service by sending crafted fragmented SSVR protocol data. Both the GV-LPC2011 and GV-LPC2211 models share the affected codebase per CPE data. Impact is limited to availability loss - no code execution or data disclosure has been demonstrated, and no public exploit code has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in the GV-Cloud component of GeoVision GV-VMS V20 20.0.2 enables a remote attacker with a network-intercept position to crash the video management system, causing high-impact denial of service against physical security infrastructure. Exploitation requires impersonating the legitimate GV-Cloud server - achieved via MitM techniques - and delivering a specially crafted network payload that corrupts stack memory in the GV-Cloud client handler. Reported by Cisco Talos (TALOS-2026-2411); no public exploit has been identified at time of analysis and no CISA KEV listing exists.
Privilege escalation in GeoVision LPC2011/LPC2211 Web Interface allows authenticated attackers to leak stored credentials via specially crafted HTTP requests to the ssi.cgi endpoint. The vulnerability affects firmware version 1.10 and requires low-privilege user access but no additional user interaction, enabling unauthenticated credential disclosure on affected devices.
Reflected cross-site scripting in GeoVision LPC2011/LPC2211 Web Interface enables remote attackers to execute arbitrary JavaScript in victim browsers via crafted URLs targeting the ssi.cgi error handler. The vulnerability chains through social engineering (requires user interaction) but achieves high confidentiality impact through changed scope (S:C), allowing session hijacking and credential theft from authenticated administrators. EPSS data not provided; no CISA KEV listing indicates this is not yet confirmed as actively exploited in the wild. Publicly available exploit code status unknown but detailed technical disclosure exists from Cisco Talos Intelligence.
Reflected cross-site scripting in GeoVision LPC2011/LPC2211 1.10 web interface (ssi.cgi) allows remote unauthenticated attackers to execute arbitrary JavaScript in victim browsers via crafted URLs. The vulnerability achieves scope change (S:C in CVSS), enabling access to high-confidentiality data across security contexts despite requiring user interaction. No public exploit code or CISA KEV listing identified at time of analysis, though vendor advisory confirms the flaw. EPSS data not available. The RCE tag appears to be a mislabeling - this is strictly client-side JavaScript execution (XSS), not server-side remote code execution.